Saturday, April 04, 2020

checkmk Installation For Infrastructure & Application Monitoring on Ubuntu 18.04.4 LTS

Introduction to checkmk can be referred to this link.

Step 1: Dependency Installation:

It may vary depending on your system. You can observe the error message, if any, during installing checkmk using package manager dpkg:

sudo apt -y install dialog graphviz apache2 apache2-utils libevent-1.4-2 php-cli php-cgi php-gd 

sudo apt -y install php-sqlite3 php-json php-pear pyro rpcbind xinetd freeradius-utils rpm lcab libfl2

Step 2: checkmk Installation:

Once the dependencies are successfully installed on Step 1, you can install checkmk with the below command:

sudo dpkg -i check-mk-enterprise-1.6.0p11.demo_0.bionic_amd64.deb

By default, your download location is located under your Downloads folder under your home directory ($HOME/Downloads). As of writing this post, I downloaded this package version check-mk-enterprise-1.6.0p11.

You will need to fix any error prior to continuing with the following steps:

sudo systemctl restart apache2
sudo omd create mysite
sudo omd start mysite

Please note that the default 'mysite' can be changed to any name you prefer. After 'sudo omd create mysite' you will be provided the generated password for the user cmkadmin as below snapshot as ab example:


You can modify the generated password by using the below command:

sudo passwd mysite
su - mysite
htpasswd -m ~/etc/htpasswd cmkadmin
sudo systemctl restart apache2

For the ease during my installation, I used password mysite for the user mysite, and password cmkadmin for the user cmkadmin. I don't encourage you to use such a very weak password in my case. It is strongly recommended, from the security point of view, to use strong alphanumeric mixed with special characters not-easy-to-guess password. Please follow recommendations from the security best practice.

Then go your browser, type http://localhost/mysite. After successfully login-ed,  the web GUI will look like the below:



If you want to wipe all the existing configuration, you can use below command to reset:

sudo omd stop mysite
sudo omd disable mysite
sudo omd --force init mysite

After the last command, a new password for user cmkadmin will be regenerated.. Please find the sample snapshot below:



Credit: checkmk, installation log can be also found on this link, omd command reference.



Internet Experience Using Google Public DNS Servers

Few days ago, I personally encountered a problem of browsing my personal blog URL https://tballah.blogspot.com, the website was intermittently working (to get connected). I contacted my ISP support for help to resolve this issue. With onsite presence, an ISP technician found out, after several troubleshooting, that using Google public DNS servers can get rid of such a problem; I am still not convinced about this fix suggested by the technician. After working for some time, the problem returns back; I need to find out the reason why this phenomenon happens. You can refer to my packet capture for the DNS resolution and TCP 3-way handshake prior to send HTTP request; you can observe that DNS query can successfully be resolved, and also there are many SYN packets sent to the host tballah.blogspot.com, there is no any SYN-ACK returned back from the host. According to the traceroute result, the SYN packets could not be passed through to reach the final destination.


Recently I figure out the issue which is from the DNS query response from tested DNS server such as 1.1.1.1, 8.8.8.8, and 202.58.98.202. If the query responds with the IP 74.125.24.132 for tballah.blogspot.com whose canonical name (CNAME) is blogspot.l.googleusercontent.com, the TCP packet (SYN) cannot go through the hop 118.69.255.57. If the query result responds with the IP 172.217.26.129 or 172.217.31.225, https://tballah.blospot.com is working. Please check the screenshot of each DNS query for every DNS server below:



My workaround solution is to configure the blue line below in /etc/hosts file (Windows also has such a host file located under %SystemRoot%\System32\drivers\etc\hosts)

172.217.26.129 blogspot.l.googleusercontent.com

Also the hop 118.69.255.57 needs to investigate the root cause for the routing of IP 74.125.24.132, while IP address 74.125.24.191 for blogger.com can pass through this hop. The workaround is just computer-based fix not recommended i.e. other users of my ISP will have the same problem I faced.

However, and undoubtedly, there are some benefits of using Google DNS service which is free to use and can be used by anyone who has access to the Internet. You can use Google DNS IP addresses instead of your ISP’s DNS servers to improve the resolve time and provide security. You can set them either on the router DHCP sever configuration or statically configure them on your network interface card (NIC).

Theses are the Google public primary, and secondary DNS servers:

    Primary IP: 8.8.8.8
Secondary IP: 8.8.4.4




Credits: an ISP technician (Piseth), and this topic