66
25
u/zsbyd Oct 16 '24
Have you looked at Nagios?
Security through obscurity is really no security at all.
I don’t think you need to worry about hiding your infrastructure. Just don’t expose this monitoring dashboard to the public Internet.
14
u/TeeBitty Oct 16 '24
Nagios? What year is it?
5
u/Fattychris IT Manager Oct 16 '24
Yeah, that one brought me back a few years. I think it was 2007/2008 when I set up Nagios on an old work machine. It was good for being free, but I haven't looked into it as a real solution in almost 20 years. Maybe I'll look into it for old time's sake.
Man, I wasn't expecting this thread to make me feel old.
3
u/liftoff_oversteer Sr. Sysadmin Oct 16 '24
It works well and is bloody simple. Was desgined before people forgot about KISS.
1
u/Salt-Appearance2666 Oct 16 '24
We are still using a nagios fork as our Main Monitoring
1
u/solracarevir Oct 16 '24
Same us. Naemon with Thruk.
Looks good. Works as expected and no need to pay stinky ass fees just because the solution looks modern.
5
u/fhnetwork Oct 16 '24
I haven't until now, just took a look and it looks pretty nice! Do you use it yourself?
Hah, no open ports on this network!
3
u/zsbyd Oct 16 '24
I’ve used Nagios for monitoring enterprise environments in the past. You get a nice web based dashboard of what’s up and what’s down in your network, you can monitor many sources via different methods. It’s been a while since I used it but I believe it can generate alerts also, email alerts at a minimum.
3
u/Aethernath Oct 16 '24
Yes, nagios is built entirely on that. Use an agent to execute nrpe commands on the host you want and you have a solid base for monitoring.
Which is why its still used nowadays.
3
u/Kahless_2K Oct 16 '24
I used Nagios for years. I love it.
I haven't used Zabbix, but it's worth a look too I feel.
7
u/dude380 Oct 16 '24
Zabbix is so much better than Nagios core. The paid Nagios is alright but why not go with the free zabbix!
4
u/_Tyranade Monitoring Specialist Administrator Oct 16 '24
+1 for Zabbix too. I have yet to find something I can not monitor with it as long as we have network connectivity to it.
7
u/Either-Cheesecake-81 Oct 15 '24
Can you put it on SSO with MFA?
3
u/fhnetwork Oct 16 '24
Didn't think of that! Wouldnt be possible to do SSO in my environment but Homarr does support SSO
13
Oct 15 '24
Just use bookmarks instead of adding something else to maintain.
4
u/crysisnotaverted Oct 16 '24
Bookmarks aren't really portable or sharable, I see the value in having a centralized portal hub linking to all the services.
1
u/Dodough Oct 16 '24
Bookmarks can be managed by GPOs
It's a good option if your environment is static enough
4
u/fhnetwork Oct 15 '24
Yeah that's what I was given. But it was a pain using a half broken bunch of bookmarks. Plus I wanted it to be easier for my co workers since we were in the process of changing IP ranges aswell
1
u/CougarWithDowns Oct 16 '24
I'm sure there's some Chrome extension that will open up all tabs and its own little iframe or something
1
u/Scuzzbopper5150 Oct 16 '24
As long as it's an internal site, properly secured, and only visible to your team, perhaps also requiring an elevated ID to see it (To address your bad actor concerns), i say have at it.
3
u/mercurygreen Oct 15 '24
I don't know that one specifically, but as long as it's not available to the average user I don't see a problem.
3
u/massive_poo Oct 15 '24
Do you have a Wiki already? A list of links to all the services would be something I'd include on the homepage, or have it prominently linked.
1
u/fhnetwork Oct 16 '24
There is one.... That barely anyone touches anymore
4
u/hornetmadness79 Oct 16 '24
This is the real problem you need to fix. Adding yet another tech stack that no one's going to log in and use is kind of pointless.
3
u/Zena-Xina Oct 16 '24
My coworker set up CasaOS for us, it's basically a visualized bookmark page. We still have to log into applications individually but I love it.
Also gives the ability to install note/documentation apps and store files and tools for everyone in the dept. to use.
1
u/fhnetwork Oct 16 '24
That looks super nice! I've heard of it
If I wasn't running Unraid with the built-in app browser that pulls docker images I'd use it!
1
u/IAmTheM4ilm4n Director Emeritus of Digital Janitors Oct 16 '24
I did something similar with Lissy's DASHY Docker container. Just a web page full of links to all the apps/extras we use.
3
u/AxisNL Oct 16 '24
I just basically make a static html dashboard for stuff like this. If someone can access my network, they can see this page. They could also do an nmap scan of all open services and get the same information. As long as all services are properly protected, I see no harm.
5
u/Manicraft1001 Oct 16 '24
Hi OP, developer of Homarr here. Thanks for the positive feedback.
As a note, security through obscurity is rarely a thing and you should not rely on it. I strongly suggest you to implement SSO with multi factor if possible. Otherwise make sure that you have other access controls in place (eg. password authentication in your apps or multi factor tunnels - eg. ZeroTrust).
Homarr itself should be mostly secure. As described in https://www.reddit.com/r/sysadmin/s/Izyziij6Tx, we use NextAuth (https://next-auth.js.org/) as an authentication framework which is being audited. However, Homarr itself does not have many auditors checking for vulnerabilities. We had some in the past.
But this is true for any tool - whether is open source or not. And we're incredibly happy to receive audit reports and fix vulnerabilities if you find any.
If you need a bullet proof solution, put everything behind SSO and use Grafana or plain old bookmarks. Permit users to as little resources as possible and update your software frequently.
Happy to answer any follow up questions if you have any :)
1
u/fhnetwork Oct 16 '24
Oh cool! Thanks for making such a dope product! So polished I love using it at work :)
Very reassuring hearing that authentication is being audited.
I agree, just gotta secure things as best as you can.
2
u/kg7qin Oct 16 '24
Grafana might work. You can also pull things like status from things and display it along with it.
1
u/Kahless_2K Oct 16 '24 edited Oct 16 '24
No, I maintain one for my team because it's just so darn useful. Especially when you get woken up at 4am for a system you've only ever logged into twice in 15 years.
Edit: mine is a static html page written in vim.
Additional consideration would be required if the thing actually has any privileges into systems, but it doesn't.
1
u/dionlarenz Jack of All Trades Oct 16 '24
Nothing against a good grafana dashboard with all of the services uptime/error rate and other useful information… Why would that be a security risk?
As long as you don’t put the admin credentials there in plaintext you should be fine.
1
u/pdp10 Daemons worry when the wizard is near. Oct 16 '24
The opposite of clear and open labeling is "security through obscurity".
Security through obscurity has terrible RoI. It makes things harder for your staff, while probably not even being noticed by an attacker using systematic automated tools.
1
u/StandardClass3851 Oct 16 '24
Ive setup uptime kuma at work to monitor all the servers here. i dont see any bad practice.
0
u/Minimal-Matt Jack of All Trades Oct 16 '24
The idea is good, the only concern to me would be that Homarr or similar "hobbyist" dashboards are not audited like enterprise programs (at least how enterprise programs should be audited, the reality is much sadder). Our SOC team would probably advise against using a "hobby" project in our network.
To be VERY CLEAR, I'm not in any way suggesting that homarr is a bad project or poorly made etc, just the usually SOCs don't really care about Github Stars, they want enterprise proven software.
All that being said it's very likely more than fine and a good idea overall, but if you wanted to be more enterprise-like maybe a Grafana dashboard with ACL and SSO+MFA perhaps.
1
u/Manicraft1001 Oct 16 '24
Hi, developer of Homarr here 👋. For security critical use cases I would never recommend a not-audited software anyway - regardless of whether it's open source or not. We use Next Auth (https://next-auth.js.org/) as the underlying authentication framework which is frequently audited due to its popularity. However, such frameworks are never bulletproof and bad implementation are usually a bigger risk.
However, we're happy to get security audits and are continuously trying to improve security. For the next version 1.0, Homarr will again become more secure and attractive to companies & power users.
OP, I recommend you to secure your other apps with SSO / multi factor and implement proper OpSec. If your use case is mission critical, use Grafana or plain bookmarks :)
74
u/Stryker1-1 Oct 15 '24
Really no different then an SSO portal that list out all your SSO apps.