Louwrentius

With the release of the new MacBook Air we are one step closer to killing off the cd-rom and the dvd. As with the previous MacBook Air, this device has no optical drive. And that is a good thing. People do not need an optical drive. You have the network and you have USB disks. They are faster, more reliable and have more capacity.

I may expect that in the upcoming years this trend may continue with the other laptops. Just as Apple killed the floppy disk, it is killing the optical drive, one step at a time. I'd rather have a smaller and lighter laptop or more disk or battery capacity, than an optical drive. So I hope this is a trend that will continue and all other manufacturers will follow.

Zabbix is a populair tool for monitoring servers, services and network equipment. For monitoring hosts, Zabbix provides an agent that can be installed on the hosts that must be monitored.

Based on the supplied documentation and some remarks on the internets, the 'security' of Zabbix agents seems to rely on an IP-filter. It only accepts traffic from a specific IP-address. However, the protocol that is used between the Zabbix server and agents is unencrypted and does not seem to employ any additional authentication.

With a man-in-the-middle attack, pretending to be the Zabbix server, you would be able to compromise all servers running Zabbix. If remote commands are enabled on these hosts, the damage that could be done may be something you don't want to think about. Or maybe you do. Although it is true that for such an attack to be possible, as an attacker you need access to a system within the same network (VLAN) as the server, but none the less, it is just not secure.

Personally I don't think that Zabbix is suitable for high-security environments, due to the lack of encryption of sensitive data and the weak authentication mechanism.

Zabbix should employ at least SSL as a means for encrypted transport and use a password or shared secret for authentication. Even better would be the use of client-side certificates such as implemented by the system management tool Puppet.

[update]

Please note that Nagios agents also seem to work this way, but I have no experience with Nagios so I can't say for sure.

And Nagios is widely deployed in the enterprise...