13.15. Setting Up Secure Remote Nagios Administration with OpenSSL

Problem

Remote Nagios logins over SSH are OK, but you would like it to be even easier. Just fire up a web browser, log in to Nagios, and be done with it. You know you can do this with OpenSSL. How do you set it up?

Solution

On Fedora, it's as easy as falling over. Simply install Apache's SSL module with this command:

	# yum -y install mod_ssl

To restrict all access to HTTPS only, make sure these lines exist in httpd.conf:

	#Listen 80
	Listen 443

On Debian, it's a few more steps. Run these commands:

	# apt-get install apache2.2-common
	# a2enmod ssl
	# cp /etc/apache2/sites-available/default /etc/apache2/sites-available/ssl
	# ln -s /etc/apache2/sites-available/ssl /etc/apache2/sites-enabled/ssl

Then, create a new self-signed SSL certificate with the apache2-ssl-certificate script, which is part of apache2-common:

	# /usr/sbin/apache2-ssl-certificate -days 365

Now, edit /etc/apache2/sites-enabled/ssl. Replace the first three lines with these lines, using your own server name or IP address:

	NameVirtualHost *:443
	<VirtualHost *:443>
	ServerName windbag.alrac.net
	SSLEngine On
	SSLCertificateFile /etc/apache2/ssl/apache.pem

Put these lines in /etc/apache2/ports.conf:

	#Listen 80
	Listen 443

Restart Apache with a force-reload:

	# /etc/init.d/apache2 force-reload
	* Forcing reload of apache 2.0 web server...    [ ok ]

Now, fire up a web browser and try http://localhost/nagios and https://localhost/nagios. Only the second one should work. The first time you connect, your browser will ask you if you want to accept the certificate. You can view it to make sure it's the right one.

Discussion

Managing SSL with Apache changed a lot between Apache 1.3 and Apache 2. Keep in mind you want mod_ssl for Apache 2, not apache_ssl.

Debian's apache2-ssl-certificate script is a small wrapper to the standard OpenSSL certificate-creation commands. It defaults to a 30-day expiration, which is probably too short for most circumstances.

See Also