Installing Centreon on a CIS-compliant OS

Hello,

I've successfully installed Centreon on a CIS-compliant OS (AlmaLinux 8). However, due to certain OS restrictions, the centreon-engine group couldn't be created during the installation process.

As a workaround, it's necessary to create the user group before proceeding with the installation:

groupadd --gid 976 centreon-engine

useradd --uid 977 --gid 976 --home /var/lib/centreon-engine --shell /bin/bash centreon-engine

CIS-compliant operating systems typically come with nftables installed and enabled (an alternative to iptables or firewalld).

First, check if nftables is started:

systemctl status nftables

Then create nftables.conf

vi /etc/nftables.conf

Add Centreon flows:

table inet filter {
    chain input {
        type filter hook input priority 0; policy drop;

        # Allow established and related connections
        ct state established,related accept

        # Allow loopback traffic
        iif lo accept

        # Allow SSH traffic
        tcp dport 22 accept

        # Allow HTTP traffic
        tcp dport 80 accept

        # Allow HTTPS traffic
        tcp dport 443 accept

        # Allow SNMP traffic
        udp dport 161 accept

        # Allow SNMPTRAP traffic
        udp dport 162 accept

        # Allow Centreon Gorgone traffic
        tcp dport 5556 accept

        # Allow Centreon Broker traffic
        tcp dport 5669 accept

        # Allow ICMP (ping) traffic
        icmp type { destination-unreachable, router-advertisement, router-solicitation, time-exceeded, parameter-problem } accept
        icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem, nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert } accept

        # Drop all other traffic
        counter drop
    }

    chain forward {
        type filter hook forward priority 0; policy drop;
    }

    chain output {
        type filter hook output priority 0; policy accept;
    }
}

Apply the configuration:

nft -f /etc/nftables.conf

To make the configuration persistent, use the following command:

nft list ruleset > /etc/sysconfig/nftables.conf

Then restart nftables:

systemctl restart nftables

Thank you
Christopher