The standard transfer method in Pandora FMS to send files, [[:en:documentation:08_technical_reference:09_tentacle|Tentacle]], needs the [[https://en.wikipedia.org/wiki/Perl|Perl]] programming language installed. Some devices, such as ESX systems (UNIX), lack this tool. When this happens, the alternatives are to use FTP or SSH to transfer monitoring data.
Pandora FMS can use the FTP or SSH protocol to copy the XML data packages generated by the [[:en:documentation:01_understanding:03_glossary#software_agent|software agents]] to the PFMS server.
-
-
Pandora FMS は、SSH プロトコルを使用して、[[:ja:documentation:01_understanding:03_glossary#ソフトウエアエージェント|ソフトウエアエージェント]]によって生成された XML データパッケージをサーバにコピーできます。
-
-
===== Pandora FMS へのデータ取り込みのための SSH 設定 =====
-
-
<WRAP center round info 60%>Always keep in mind Pandora FMS [[:en:documentation:07_technical_annexes:15_security_architecture|Security Architecture]].</WRAP>
-
-
<WRAP center round info 60%>常に、Pandora FMS の [[:ja:documentation:07_technical_annexes:15_security_architecture|セキュリティアーキテクチャ]] に注意してください。</WRAP>
-
-
Consider Pandora FMS server as **Server** and each one of the devices running the Software Agent as **Client**. You may always check which user you are working with by means of the **whoami** command.
**Step 1**: Create a ''pandora'' user in the machine where Pandora FMS server is running. This machine will receive the data through SSH. If you have already installed a Pandora FMS server, surely this user is already created. Set a strong password for that user with the command:
**Step 3**: Create, on each machine running a Software Agent that will use SSH, a pair of keys (private and public). To do this, execute the following command **with the same user with which Pandora FMS Software Agent is executed**:
A series of questions will appear to which you will have to answer by simply pressing the Enter key. With this you have created a public key and a private key for that user in the machine. Now you should copy it to the destination machine, which is the Pandora FMS server where you want to send the monitoring data.
<WRAP center round info 60%>The ''authorized_keys'' file on the Server must belong (ownership) to the user ''pandora:root'' and must have permissions ''600''</WRAP>
-
-
<WRAP center round info 60%>サーバの ''authorized_keys'' ファイルの所有者とグループは ''pandora:root'' で、パーミッションは ''600'' である必要があります。</WRAP>
-
-
=== 自動コピー ===
-
-
Use the following command at **Client**:
-
-
**クライアント** にて次のコマンドを利用します。
-
-
<file>
-
ssh-copy-id pandora@<Server-address>
-
-
</file>
-
-
Where ''<Server-address>'' is the IP address or URL of the **Server**.
-
-
ここで、''<Server-address>'' は、**サーバ** の IP アドレスまたは URL です。
-
-
It will ask for the server's ''pandora'' user password ([[:en:documentation:07_technical_annexes:01_ssh_and_ftp_setup#user_creation_in_server|set in step 1]]) and, once confirmed, it will display a message similar to the following:
Now try logging into the machine, with "ssh '<Server-address>'", and check in:
-
.ssh/authorized_keys
-
to make sure we haven't added extra keys that you weren't expecting.
-
-
</file>
-
-
Perform this test to verify automatic connection to Pandora FMS **Server** with the ''pandora'' user from the **Client** (with the user running the Software Agent):
Once you have verified the connection through SSH, this will be the method used by the software agents to copy data to Pandora FMS Server directory. This directory is located at:
Finally, modify the [[:en:documentation:02_installation:05_configuration_agents#transfer_mode|software agent configuration]] in the **Client** to specify that the copying method is SSH. This is modified in ''/etc/pandora/pandora_agent.conf'' file, in the ''transfer_mode'' configuration token. Remember to restart the software agent service on each Client after this change.
[[https://pandorafms.com/blog/information-security/|{{ :wiki:pfms-cyber_attack.png?nolink& |Absolutely no one is safe from security attacks}}]]
-
-
Pandora FMS uses, among others, sftp/ssh2 ([[https://es.wikipedia.org/wiki/Secure_Copy|SCP]]) to copy data files from the software agents to the server. Therefore, you will need at least one data server with an SSH2 server listening to the ''pandora'' user. This could be a significant risk in a network that needs to be strictly secured. OpenSSH2 is **very** secure, but in terms of computer security, there is nothing that is absolutely secure; so, measures must be taken to make it "more" secure.
Open SSH2 は **非常に** 安全ですが、コンピュータのセキュリティに関しては、絶対に安全なものはないため、"より安全" にするための対策を講じてください。
-
-
<WRAP center round info 60%>Always keep in mind Pandora FMS [[:en:documentation:07_technical_annexes:15_security_architecture|Security Architecture]].</WRAP>
-
-
<WRAP center round info 60%>常に、Pandora FMS の [[:en:documentation:07_technical_annexes:15_security_architecture|セキュリティアーキテクチャ]] に注意してください。</WRAP>
-
-
It is possible to prevent SSH access for certain users, as well as to configure restrictions on FTP access.
To do this, modify the ''pandora'' user on the **Server**. This user must have a [[:en:documentation:07_technical_annexes:01_ssh_and_ftp_setup#user_creation_in_server|strong password]]. Its login shell will be changed to restrict SSH access to the user, and its ''home'' directory, to prevent its access to other folders:
With these changes to the ''pandora ''user on the **Server**, when logging in via SSH, such user will not be able to execute commands with it in an interactive terminal.
<WRAP center round tip 60%>(See the [[:es:documentation:02_installation:01_installing#requisitos_minimos_de_software|recommended operating systems]] for Pandora FMS.) In Debian systems the shell path is ''/usr/sbin/nologin''.</WRAP>
The client settings for sending data via FTP allow you to specify the user and password to be sent, making it quite easy to implement FTP copying instead of [[:en:documentation:08_technical_reference:09_tentacle|Tentacle]].
[[https://pandorafms.com/blog/file-transfer-protocol/|{{ :wiki:pfms-what-is-ftp.png?nolink& |What is File Transfer Protocol (FTP)?}}]]
-
-
Besides configuring Pandora FMS software agents to send data with FTP, **you will have to configure an FTP server where you execute Pandora FMS server**, [[:en:documentation:07_technical_annexes:01_ssh_and_ftp_setup#creating_a_server_user|establish a password]] for the ''pandora'' user and allow writing access to the ''pandora'' user to the ''/var/spool/pandora/data_in'' directory and its subdirectories.
This means that you should configure the FTP server to adapt it to these needs; for this, in this guide **[[https://de.wikipedia.org/wiki/Vsftpd|vsFTPd]]** is used.
For this reason, and in the same way that the [[:en:documentation:07_technical_annexes:01_ssh_and_ftp_setup#ssh_server_assuring|SSH login has been disabled]] for the ''pandora'' user for security reasons, a safe access method should be established for the FTP users. A safe and simple method for this is to create a PAM rule for **vsftpd**. For this you should create a file called ''/etc/pam.d/ftp'' containing the following:
<WRAP center round tip 60%>(See the [[:es:documentation:02_installation:01_installing#requisitos_minimos_de_software|recommended operating systems]] for Pandora FMS.) In Debian systems the shell path is ''/usr/sbin/nologin''.</WRAP>
With this configuration, only the users that belong to the ''pandora'' group and have ''nologin'' as associated //shell// will be able to connect to Pandora FMS by FTP, //so you should create the// ''pandora'' //group// that includes the ''pandora'' user. In any case, verify that both exist in the **Server**.
With a last configuration of the ''/etc/vsftpd.conf'' file, the access of the users that access by FTP its root directory will be restricted. The parameters are as follows:
In case you need to exclude a user from this and avoid restricting it to your **Chroot**, just include that user in this ''vsftpd.nochroot_list'' file (one user per line).
With this configuration, the user will be restricted to its root directory (''/var/spool/pandora/data_in'' in the case of the ''pandora'' user). The user will be able to make transfers via FTP (send files), **but will not be able to list files**.
Try to log in with the pandora user in the FTP, change directory and list files; if it does **not** succeed, the configuration will have been successful.