4 ms·

Zabbix – A Case Study of Unsafe Session Storage

43 points by feross 5y ago

riffic 5y ago
this kind of stuff shouldn't be exposed to the open internet. use an internal network with vpn or at the very least look at something like Cloudflare Access.
- KronisLV 5y ago
  Why not just something like basicauth (or mTLS for all i care) at the reverse proxy web server level, at least for relatively low value assets? It seems like security related functionality always has flaws or there are other RCEs that pop their heads up every now and then, another one in recent memory was an exiftool problem in GitLab: https://nvd.nist.gov/vuln/detail/CVE-2021-22205 https://nvd.nist.gov/vuln/detail/CVE-2021-22205 So why not introduce software with a better track record, like web servers as an additional security layer (at least against automated attacks). In my eyes, that's a good middle ground between needing a VPN and having everything open, because zero trust doesn't work well when you don't constantly keep track of CVEs for the software etc. and have the resources to mitigate those almost immediately. So, why would that fail, apart from basicauth not being the best solution technically?
gnabgib 5y ago
Source/Origin article (linked in the "Patch now" section): "Zabbix - A Case Study of Unsafe Session Storage"[0] [0]: https://blog.sonarsource.com/zabbix-case-study-of-unsafe-session-storage https://blog.sonarsource.com/zabbix-case-study-of-unsafe-ses...
- dang 5y ago
  Changed from https://portswigger.net/daily-swig/critical-vulnerabilities-in-zabbix-web-frontend-allow-authentication-bypass-code-execution-on-servers https://portswigger.net/daily-swig/critical-vulnerabilities-.... Thanks!
bitcharmer 5y ago
I used zabbix 20 years ago. In the age of Grafana, InfluxDb, Prometheus, etc does it have any advantages any more?
- bluedino 5y ago
  Installed base
- mappu 5y ago
  RRD (zabbix/munin/...) is still better at long-term data storage - if you want to see multi-year trends then Prometheus will take ~TBs of space at its default 15s resolution with no unified downsampling system.
- justsomehnguy 5y ago
  You still need a way to extract data from the endpoint (ie an agent). So in the age of Grafana you can use Zabbix as a source of data and use Grafana to visualize it: https://grafana.com/grafana/plugins/alexanderzobnin-zabbix-app/ https://grafana.com/grafana/plugins/alexanderzobnin-zabbix-a... Also different needs do require different solutions. For a "classic" (not a Web 3.0 hypercoverged containerised backend for a smartphone app to watch cat videos) environment Zabbix is still, though clumsy someties, a good way. also, take a look at Zabbix 5 and 6 release notes. While IMO some things should had been implemented years ago - they are finally there.
VWWHFSfQ 5y ago
Zabbix was great! When I used it...15 years go. The UI was super clunky and weird, it was slow, but it did exactly what we wanted. I haven't looked into it in a long time, so this is a bit of a blast-from-the-past for me. Also, are people still using Nagios? I think for my next venture I'm just going to colo some bare-metal servers instead of AWS. What is the state-of-the-art for server-level/app-level monitoring for that these days?
- k8sToGo 5y ago
  Prometheus with grafana
  - brimstedt 5y ago
    Is it possible to get alerts with Prometheus, as powerful as those of zabbix?
- barbazoo 5y ago
  We started using Zabbix recently and I'm not crazy about the UI, especially the graphs. Maybe our setup is wrong but they weren't interactive, you couldn't customize them much and half of the time it's unclear what timezone the data is in.
  - KronisLV 5y ago
    I actually still use Zabbix for all of my personal servers, because it's pretty decent at what it does. For the most part, you just set up the agent on the nodes that you want to monitor, add some configuration to allow the server to request the data (or add the configuration to push the data, rather than use a pull model) and add the server in the web UI. Moments later, most of the data that you could care for will start flowing in, depending on which OS template you've selected. As for the graphs, you will probably want to be aware that there are three types that are supported, two of which are historical (the "classic" and "classic - simple" ones, which weren't removed not to break anything) and the remaining type being more customizable and a bit more dynamic. Here's an example of all three types, the bottom one being the interactive kind: https://i.imgur.com/avhPoCO.png https://i.imgur.com/avhPoCO.png Here's a gallery of the customization options, though most of them weren't relevant for me, because i didn't necessarily want to customize the graphs much in my dashboard, given that there are tens of them in there (i just wanted something to show some key metrics for all of my servers in a single page): https://imgur.com/a/9Ervntg https://imgur.com/a/9Ervntg Oh, also the network map (with information about host problems) and web monitoring functionality is pretty nice, since i can also use Zabbix for checking how responsive all of the sites that are actually hosted on the server are and whether anything has gone down. Overall, it's a pretty low maintenance piece of software with sensible defaults in regards to what it monitors and what causes alerts to be created. I only wish that it would be easier to customize it further (e.g. aggregating data at slightly longer intervals to store less data about my homelab, though their mass update functionality is pretty okay; or automatically creating graphs for new nodes), or that it would allow for e-mail/other alerts for web monitoring out of the box, as a default. Also, when configuring maintenance periods (because i don't want alerts about my servers going down when i've scheduled them to do that), the time zones etc. can indeed be a bit confusing and the UI is generally a tad clunky. Also, it runs on pretty boring software (MariaDB/MySQL for the data) and the system requirements aren't too demanding, so i don't need a separate node, merely a few containers with about 512 MB of memory and 1 CPU core for each.

43 points by feross 5y ago

this kind of stuff shouldn't be exposed to the open internet. use an internal network with vpn or at the very least look at something like Cloudflare Access.

KronisLV 5y ago
Why not just something like basicauth (or mTLS for all i care) at the reverse proxy web server level, at least for relatively low value assets? It seems like security related functionality always has flaws or there are other RCEs that pop their heads up every now and then, another one in recent memory was an exiftool problem in GitLab: https://nvd.nist.gov/vuln/detail/CVE-2021-22205 https://nvd.nist.gov/vuln/detail/CVE-2021-22205 So why not introduce software with a better track record, like web servers as an additional security layer (at least against automated attacks). In my eyes, that's a good middle ground between needing a VPN and having everything open, because zero trust doesn't work well when you don't constantly keep track of CVEs for the software etc. and have the resources to mitigate those almost immediately. So, why would that fail, apart from basicauth not being the best solution technically?

gnabgib 5y ago

Source/Origin article (linked in the "Patch now" section): "Zabbix - A Case Study of Unsafe Session Storage"[0] [0]: https://blog.sonarsource.com/zabbix-case-study-of-unsafe-session-storage https://blog.sonarsource.com/zabbix-case-study-of-unsafe-ses...

dang 5y ago
Changed from https://portswigger.net/daily-swig/critical-vulnerabilities-in-zabbix-web-frontend-allow-authentication-bypass-code-execution-on-servers https://portswigger.net/daily-swig/critical-vulnerabilities-.... Thanks!

bitcharmer 5y ago

I used zabbix 20 years ago. In the age of Grafana, InfluxDb, Prometheus, etc does it have any advantages any more?

bluedino 5y ago
Installed base
mappu 5y ago
RRD (zabbix/munin/...) is still better at long-term data storage - if you want to see multi-year trends then Prometheus will take ~TBs of space at its default 15s resolution with no unified downsampling system.
justsomehnguy 5y ago
You still need a way to extract data from the endpoint (ie an agent). So in the age of Grafana you can use Zabbix as a source of data and use Grafana to visualize it: https://grafana.com/grafana/plugins/alexanderzobnin-zabbix-app/ https://grafana.com/grafana/plugins/alexanderzobnin-zabbix-a... Also different needs do require different solutions. For a "classic" (not a Web 3.0 hypercoverged containerised backend for a smartphone app to watch cat videos) environment Zabbix is still, though clumsy someties, a good way. also, take a look at Zabbix 5 and 6 release notes. While IMO some things should had been implemented years ago - they are finally there.

VWWHFSfQ 5y ago

Zabbix was great! When I used it...15 years go. The UI was super clunky and weird, it was slow, but it did exactly what we wanted. I haven't looked into it in a long time, so this is a bit of a blast-from-the-past for me. Also, are people still using Nagios? I think for my next venture I'm just going to colo some bare-metal servers instead of AWS. What is the state-of-the-art for server-level/app-level monitoring for that these days?

k8sToGo 5y ago
Prometheus with grafana
- brimstedt 5y ago
  Is it possible to get alerts with Prometheus, as powerful as those of zabbix?
barbazoo 5y ago
We started using Zabbix recently and I'm not crazy about the UI, especially the graphs. Maybe our setup is wrong but they weren't interactive, you couldn't customize them much and half of the time it's unclear what timezone the data is in.
- KronisLV 5y ago
  I actually still use Zabbix for all of my personal servers, because it's pretty decent at what it does. For the most part, you just set up the agent on the nodes that you want to monitor, add some configuration to allow the server to request the data (or add the configuration to push the data, rather than use a pull model) and add the server in the web UI. Moments later, most of the data that you could care for will start flowing in, depending on which OS template you've selected. As for the graphs, you will probably want to be aware that there are three types that are supported, two of which are historical (the "classic" and "classic - simple" ones, which weren't removed not to break anything) and the remaining type being more customizable and a bit more dynamic. Here's an example of all three types, the bottom one being the interactive kind: https://i.imgur.com/avhPoCO.png https://i.imgur.com/avhPoCO.png Here's a gallery of the customization options, though most of them weren't relevant for me, because i didn't necessarily want to customize the graphs much in my dashboard, given that there are tens of them in there (i just wanted something to show some key metrics for all of my servers in a single page): https://imgur.com/a/9Ervntg https://imgur.com/a/9Ervntg Oh, also the network map (with information about host problems) and web monitoring functionality is pretty nice, since i can also use Zabbix for checking how responsive all of the sites that are actually hosted on the server are and whether anything has gone down. Overall, it's a pretty low maintenance piece of software with sensible defaults in regards to what it monitors and what causes alerts to be created. I only wish that it would be easier to customize it further (e.g. aggregating data at slightly longer intervals to store less data about my homelab, though their mass update functionality is pretty okay; or automatically creating graphs for new nodes), or that it would allow for e-mail/other alerts for web monitoring out of the box, as a default. Also, when configuring maintenance periods (because i don't want alerts about my servers going down when i've scheduled them to do that), the time zones etc. can indeed be a bit confusing and the UI is generally a tad clunky. Also, it runs on pretty boring software (MariaDB/MySQL for the data) and the system requirements aren't too demanding, so i don't need a separate node, merely a few containers with about 512 MB of memory and 1 CPU core for each.