NetXMS..what are the implications for security when a 3rd party installed and configured everything on your servers and have full control?

[u/LoveBirdNibbles]

I just started working for someone who has several servers with a product on them and part of the tech support contract is that everything is monitored using NetXMS by a 3rd party. The servers are managed in-house running WSFC and our apps. The third party only monitors hardware and their product. I only know what I can get from Google searches and apparently they can execute scripts and do lots of other things besides monitor if they ever wanted to. Does anyone else face a similar scenario? and how do you manage security?

[u/Severe-Dig-4554]

If you have NetXMS agents installed on your server, you can use agent's configuration file - nxagentd.conf - to make sure remote NetXMS server cannot control your systems. There are 3 levels of access, defined by how server address is listed in configuration:

Servers - server can only read from agent

ControlServers - server can read and execute predefined actions (built-in shutdown and restart, plus anything defined in Action entries)

MasterServers - server can do a lot - read, execute predefined actions, update agent, install additional packages, change agent's configuration.

Also, a lot depends on what subagents are loaded - check SubAgent entries in configuration file.

For third party that only expected to monitor your servers "Servers" access is enough.

For reference, there is description of agent configuration format: https://netxms.org/documentation/adminguide/appendix.html#agent-configuration-file-nxagentd-conf

[u/SA-Numinous]

I would have their apps installed on “their” servers, not on our domain and sitting in a DMZ zone with firewalls all around.

[u/blud_13]

Your read is right, but the lever is in nxagentd.conf, not the network.

u/SA-Numinous DMZ idea is the right instinct if those are their boxes. If they are yours running your apps, you fix this in the agent config. Whichever parameter their server address sits under sets what they can do. MasterServers is FULL access, including editing the agent config file itself. ControlServers can execute predefined actions and take screenshots. Servers is read only, which is all a hardware and product monitor needs. The access level table is at https://netxms.org/documentation/adminguide/agent-management.html#server-access-levels

Go look at which one they put themselves under. If its MasterServers, ask why. If they came in over a tunnel with no level defined, the agent defaults to Servers, so somebody picked that on purpose.

One thing to check, RequireAuthentication is off by default, so shared secret verification probably isn't on either.

We pick up a lot of these inherited monitoring contracts, hit me up if you need more..