ZenPack Security

We take the security of our systems and customers seriously. This means that we provide the most secure access to our customers devices as possible. The following outlines some of the general concepts.

General Stuff

  • Always use password type of zProperty for passwords
  • Use TALES expressions with password zProps in composite credentials like ConnectionStrings
  • Document the creation of special restricted accounts on targets for more secure access.

SSH and Sudo Access

Often we use SSH in combination with sudo to access system data for Unix type systems. Here are some guidelines to mitigate customers having objections or other access problems.

  1. Clearly document that we assume sudo NOPASSWD access for full functionality.
  2. Document the exact minimal sudoers configuration we require.
  3. Verify that we fail gracefully during modeling and monitoring in the following cases.
    1. sudo not installed.
    2. user not in sudoers.
    3. sudo requiring password.

Below is an example of an /etc/sudoers file that has minimal access for the commands:

  • /sbin/service –status-all
  • /sbin/initctl list

This is the /etc/sudoers file:

# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
Defaults  mail_badpass
Defaults  secure_path="/usr/sbin:/usr/bin:/sbin:/bin"

Cmnd_Alias STATUS = /sbin/service --status-all, /sbin/initctl list

# User privilege specification
root    ALL=(ALL:ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

# Allow zenoss user access to STATUS commands
zenoss   ALL = NOPASSWD: STATUS

On newer systems, it is often better to take the advice listed in /etc/sudoers and put local commands into /etc/sudoers.d/zenoss because there is less chance that this setup is lost on upgrades:

# file: /etc/sudoers.d/zenoss for zenoss access
# This file won't get overwritted by upgrades

# Commands for getting system status
Cmnd_Alias STATUS = /sbin/service --status-all, /sbin/initctl list
# Allow zenoss user access to STATUS commands
zenoss   ALL = NOPASSWD: STATUS