-
Notifications
You must be signed in to change notification settings - Fork 0
Security
This plugin makes HTTP requests from the Checkmk server to operator-configured URLs. Treat the rule as trusted input and restrict who may edit it.
A URL pointing at internal services — or one that redirects there — can be used as a server-side request forgery (SSRF) vector, because the request originates from the monitoring server, inside your network.
- Restrict who can edit the Generic JSON API ruleset.
- Follow HTTP redirects is on by default (for back-compat). In locked-down environments, turn it off per endpoint, so a redirect to an internal address fails instead of being followed — this closes the redirect-based SSRF amplification path.
TLS verification is on by default. Disabling it (Verify the TLS certificate → off) is insecure and opt-in per rule — prefer fixing the certificate over turning verification off.
Credentials (HTTP basic password, bearer token) are stored in the Checkmk password store and passed to the agent as a store reference, never in clear text on the command line. Create entries under Setup → Passwords.
Do not open a public issue for a security problem. Report it privately via GitHub's advisory flow — see SECURITY.md.
Back to Home · Configuration.