Nagios - Hardened Infrastructure Monitoring

What is Nagios Core

Nagios Core is one of the longest-established open source monitoring servers for hosts, services and network devices. It is a set of compiled C daemons with an Apache CGI and PHP web interface, and it deliberately keeps no SQL database: current state, retention and the event log live in flat files, which is what makes it light enough to watch hundreds of hosts from a small VM. Monitoring is done by check plugins, small executables that return a status and a line of output, so anything you can write a script for can be monitored. This image ships Nagios Core 4.5.14 with Nagios Plugins 2.5, covering ping, disk, load, users, processes, SSH, HTTP, SMTP, SNMP, DNS and NTP. Scheduling, flap detection, dependencies, escalations, notification commands and an external command pipe are all part of the core.

Why self-host monitoring

Monitoring data is an unusually complete map of your estate: hostnames, addresses, service inventory, response times and outage history. Self-hosting keeps all of it inside your own subscription, under your own retention and access rules, with no per-host or per-metric pricing to plan around. The configuration is plain text, so it lives in your own version control and can be reviewed like any other infrastructure code.

What this VM image adds

Security hardening:

• Web password generated at first boot - unique per instance, stored only as a bcrypt hash; the image itself ships a locked account with no usable credential
• Web interface bound to loopback - the CGI web server listens on 127.0.0.1 only, with nginx terminating TLS on 443 in front of it
• TLS ready - self-signed certificate out of the box, Certbot pre-installed so a CA-signed certificate is one command away
• No phone-home - vendor update checks are disabled; the instance does not report its version to any third party
• Unprivileged daemon - runs as its own user with a restricted umask, and the compiler toolchain is removed from the shipped image
• CVE scan - every image is scanned for vulnerabilities with Trivy before release
• UFW firewall - SSH 22 and HTTPS 443 only; port 80 answers with a redirect to HTTPS and carries the certificate-issuance challenge, nothing else
• fail2ban - SSH brute-force protection
• AppArmor - mandatory access control

OS hardening (CIS Level 1):

• CIS Level 1 hardened - CIS Ubuntu 24.04 LTS Level 1 Benchmark via ansible-lockdown
• auditd - system call auditing for critical paths
• SSH hardening - PasswordAuthentication disabled, key-only access
• Kernel hardening - SYN cookies, ASLR, rp_filter, TCP BBR
• /tmp as tmpfs - nosuid, nodev, noexec
• Azure IMDS endpoints - egress rules pre-configured (169.254.169.254, 168.63.129.16)

Compliance artifacts (inside the VM):

• SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
• CIS Conformance Report - OpenSCAP HTML at /etc/lynxroute/cis-report.html
• Tailored CIS profile - /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md

Quick Start

1. Deploy VM from Azure Marketplace (Standard_D2s_v3 recommended)
2. SSH: ssh -i key.pem <username>@<PUBLIC_IP> (username set during VM creation, default: azureuser)
3. Read the generated password: sudo cat /root/nagios-credentials.txt
4. Open https://<PUBLIC_IP>/, accept the self-signed certificate, then sign in as nagiosadmin
5. The local host is already monitored; add your own hosts under /usr/local/nagios/etc/objects/ and reload

Restrict NSG port 443 to your own address until you have signed in and set your own password.