Open port 10050

[oliverm]

Hi

Typically on the firewalls of client servers which we monitor, we open port 10050 but restrict to to only being accessed by the IP of our monitoring server.

However, at this one location, the firewall is such that it wont limit by external source IP.

What level of risk is there in leaving port 10050 open on the firewall for any external source IP ? Is the data that flows over that port unencrypted or encrypted by default ?

Olly

[gryphius]

Data is unencrypted by default (in fact, I normally just telnet my agent on port 10050 and type in a key to check if everything works ok)

Your agent should only accept queries from the Server IP(s) that is/are configured as in zabbix_agentd.conf

If this is really safe, I don't know though.

Maybe you could use ssh tunnelling to make things more secure?

[oliverm]

*&^%$**^ing cheap routers !!!!

[pacharest]

You might consider switching this specific server to active check, you might also install a host-firewall allowing access only from your zabbix master.

Pascal

[oliverm]

Any idea how to make it work over SSL between zabbix server and client ?

Olly

[marc]

you may can use ssh -L10052:localhost:10050 -R10050:localhost:10052 remotebox and use localhost 10052 in zabbix server to monitor the remote box
i dont like the above suggestion, it will result in another point of failure. monitoring strategy should be "keep it simple".
i like the idea (some posts above) of using a simple host firewall (windows native one, iptables, ipfw, pf whatsorever) and limit this one port to accept only connections from your zabbix server.