[HN Gopher] Zabbix - A Case Study of Unsafe Session Storage
       ___________________________________________________________________
        
       Zabbix - A Case Study of Unsafe Session Storage
        
       Author : feross
       Score  : 26 points
       Date   : 2022-02-18 14:47 UTC (8 hours ago)
        
 (HTM) web link (blog.sonarsource.com)
 (TXT) w3m dump (blog.sonarsource.com)
        
       | VWWHFSfQ wrote:
       | Zabbix was great! When I used it...15 years go. The UI was super
       | clunky and weird, it was slow, but it did exactly what we wanted.
       | I haven't looked into it in a long time, so this is a bit of a
       | blast-from-the-past for me. Also, are people still using Nagios?
       | I think for my next venture I'm just going to colo some bare-
       | metal servers instead of AWS. What is the state-of-the-art for
       | server-level/app-level monitoring for that these days?
        
         | k8sToGo wrote:
         | Prometheus with grafana
        
       | riffic wrote:
       | this kind of stuff shouldn't be exposed to the open internet. use
       | an internal network with vpn or at the very least look at
       | something like Cloudflare Access.
        
         | KronisLV wrote:
         | Why not just something like basicauth (or mTLS for all i care)
         | at the reverse proxy web server level, at least for relatively
         | low value assets?
         | 
         | It seems like security related functionality always has flaws
         | or there are other RCEs that pop their heads up every now and
         | then, another one in recent memory was an exiftool problem in
         | GitLab: https://nvd.nist.gov/vuln/detail/CVE-2021-22205
         | 
         | So why not introduce software with a better track record, like
         | web servers as an additional security layer (at least against
         | automated attacks). In my eyes, that's a good middle ground
         | between needing a VPN and having everything open, because zero
         | trust doesn't work well when you don't constantly keep track of
         | CVEs for the software etc. and have the resources to mitigate
         | those almost immediately.
         | 
         | So, why would that fail, apart from basicauth not being the
         | best solution technically?
        
       | bitcharmer wrote:
       | I used zabbix 20 years ago. In the age of Grafana, InfluxDb,
       | Prometheus, etc does it have any advantages any more?
        
         | mappu wrote:
         | RRD (zabbix/munin/...) is still better at long-term data
         | storage - if you want to see multi-year trends then Prometheus
         | will take ~TBs of space at its default 15s resolution with no
         | unified downsampling system.
        
         | bluedino wrote:
         | Installed base
        
       | gnabgib wrote:
       | Source/Origin article (linked in the "Patch now" section):
       | "Zabbix - A Case Study of Unsafe Session Storage"[0]
       | 
       | [0]: https://blog.sonarsource.com/zabbix-case-study-of-unsafe-
       | ses...
        
         | dang wrote:
         | Changed from https://portswigger.net/daily-swig/critical-
         | vulnerabilities-.... Thanks!
        
       ___________________________________________________________________
       (page generated 2022-02-18 23:01 UTC)