Listing Thumbnail

    Nagios - Hardened Infrastructure Monitoring

     Info
    Sold by: Lynxroute 
    Deployed on AWS
    Free Trial
    This product has charges associated with it for hardening, security configuration, and support. Nagios Core is a host, service and network monitoring server built as compiled C daemons with an Apache CGI web interface, holding all check state in flat files rather than a database. This Lynxroute build is hardened and ready out of the box: the web password is generated at first boot and stored as a bcrypt hash, the web interface is bound to loopback behind an nginx TLS perimeter, vendor update checks are switched off so the instance never phones home, UFW firewall pre-configured, and a CIS Level 1 hardened Ubuntu 24.04 LTS base. GPL-2.0 license - fully auditable, no vendor lock-in.

    Overview

    This is a repackaged software product wherein additional charges apply for hardening, security configuration, and support.

    WHAT IS NAGIOS CORE

    Nagios Core is one of the longest-established open source monitoring servers for hosts, services and network devices. It is a set of compiled C daemons with an Apache CGI and PHP web interface, and it deliberately keeps no SQL database: current state, retention and the event log live in flat files, which is what makes it light enough to watch hundreds of hosts from a small instance. Monitoring is done by check plugins, small executables that return a status and a line of output, so anything you can write a script for can be monitored. This image ships Nagios Core 4.5.14 with Nagios Plugins 2.5, covering ping, disk, load, users, processes, SSH, HTTP, SMTP, SNMP, DNS, NTP and many more. Scheduling, state flapping detection, dependencies, escalations, notification commands and an external command pipe are all part of the core. GPL-2.0 license, no vendor lock-in.

    WHAT THIS AMI ADDS

    Security hardening:

    • Web password generated at first boot, unique per instance, stored only as a bcrypt hash - the AMI itself ships a locked account with no usable credential
    • Web interface served by Apache bound to 127.0.0.1 only, with nginx terminating TLS on 443 in front of it
    • Self-signed certificate out of the box and Certbot pre-installed, so a CA-signed certificate is one command away
    • Vendor update checks disabled - the instance does not report its version to any third party
    • The monitoring daemon runs unprivileged with a restricted umask, and the compiler toolchain is removed from the shipped image
    • UFW firewall pre-configured - SSH 22 and HTTPS 443; port 80 only redirects to HTTPS and carries the certificate-issuance challenge
    • fail2ban, AppArmor
    • CVE scan - every image is scanned for vulnerabilities before release

    OS hardening (CIS Level 1):

    • CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
    • auditd, SSH hardening, Kernel hardening, IMDSv2 enforced

    Compliance artifacts:

    • SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
    • CIS Conformance Report at /etc/lynxroute/cis-report.html
    • CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md

    Highlights

    • Nagios security baked in: web password generated at first boot and stored as a bcrypt hash, no usable credential in the image itself, web interface bound to loopback behind an nginx TLS perimeter, vendor update checks disabled so the instance never phones home, UFW firewall pre-configured.
    • CIS Level 1 hardened Ubuntu 24.04 LTS: auditd, fail2ban, AppArmor, SSH key-only, IMDSv2 enforced. CVE-scanned before every release. SBOM (CycloneDX) and CIS Conformance Report included.
    • Agentless-first monitoring with no database to run: check plugins for ping, disk, load, processes, SSH, HTTP, SNMP, DNS and more, plus scheduling, dependencies, escalations and notification commands. GPL-2.0 license - fully auditable, no vendor lock-in.

    Details

    Delivery method

    Delivery option
    64-bit (x86) Amazon Machine Image (AMI)

    Latest version

    Operating system
    Ubuntu 24.04

    Deployed on AWS
    New

    Introducing multi-product solutions

    You can now purchase comprehensive solutions tailored to use cases and industries.

    Multi-product solutions

    Features and programs

    Financing for AWS Marketplace purchases

    AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
    Financing for AWS Marketplace purchases

    Pricing

    Free trial

    Try this product free for 5 days according to the free trial terms set by the vendor. Usage-based pricing is in effect for usage beyond the free trial terms. Your free trial gets automatically converted to a paid subscription when the trial ends, but may be canceled any time before that.

    Nagios - Hardened Infrastructure Monitoring

     Info
    Pricing is based on actual usage, with charges varying according to how much you consume. Subscriptions have no end date and may be canceled any time.
    Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator  to estimate your infrastructure costs.

    Usage costs (5)

     Info
    Dimension
    Cost/hour
    t3.medium
    Recommended
    $0.05
    t3.large
    $0.05
    t3.small
    $0.03
    m6i.xlarge
    $0.05
    m6i.large
    $0.05

    AI Insights

     Info

    Dimensions summary

    You pay by the hour based on the EC2 instance size you launch. The five options map to different compute capacities. The t3.small, t3.medium, and t3.large run on burstable instances, scaling up in size and hourly rate. The m6i.large and m6i.xlarge run on general-purpose instances for steadier workloads. You pick the instance that fits your monitoring load; the hourly software rate rises with the size you choose. Billing runs through AWS by the hour, with no upfront commitment. Every instance ships with the same hardened, pre-configured Ubuntu base regardless of size.

    Top-of-mind questions for buyers

    The t3.small, t3.medium, and t3.large run on burstable instances. They handle variable loads that spike then settle. The m6i.large and m6i.xlarge run on general-purpose instances built for steady, continuous monitoring. Pick t3 for intermittent demand and m6i for sustained workloads.
    The software rate meters running instance-hours. A fully stopped instance stops accruing the hourly software charge. You may still pay underlying AWS storage fees for stored volumes while stopped. Only running time counts toward the software rate you selected.
    Every instance ships on a CIS Level 1 hardened Ubuntu 24.04 base. It includes a CVE scan, a bundled software bill of materials, a conformance report, firewall, and unique credentials generated at first boot. These artifacts stay inside your own deployed instance.
    lynxroute.com
    Helpful?

    Vendor refund policy

    We do not offer refunds for this product. AWS infrastructure charges (EC2, EBS, data transfer) are billed separately by AWS and are not refundable by us.

    How can we make this page better?

    Tell us how we can improve this page, or report an issue with this product.
    Tell us how we can improve this page, or report an issue with this product.

    Legal

    Vendor terms and conditions

    Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .

    Content disclaimer

    Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.

    Usage information

     Info

    Delivery details

    64-bit (x86) Amazon Machine Image (AMI)

    Amazon Machine Image (AMI)

    An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.

    Version release notes

    Nagios Core 4.5.14 - Initial release (August 2026)

    • Nagios Core 4.5.14 with Nagios Plugins 2.5 on Ubuntu 24.04 LTS
    • CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)
    • CVE-scanned before every release
    • Web password generated at first boot, unique per instance, stored as a bcrypt hash
    • Web interface bound to 127.0.0.1 behind an nginx TLS perimeter on 443
    • Self-signed certificate plus Certbot for one-command CA-signed TLS
    • Vendor update checks disabled - no phone-home from the instance
    • UFW firewall pre-configured (SSH 22, HTTPS 443, and port 80 for the HTTPS redirect and certificate issuance)
    • fail2ban, auditd, AppArmor pre-configured
    • SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json
    • CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html
    • IMDSv2 enforced

    Additional details

    Usage instructions

    1. Launch instance (t3.small minimum, t3.medium recommended)
    2. Open Security Group - allow TCP 443 from your IP (and TCP 80 if you will use certbot)
    3. SSH: ssh -i key.pem ubuntu@<PUBLIC_IP>
    4. Read credentials: sudo cat /root/nagios-credentials.txt
    5. Open https://<PUBLIC_IP>/ in your browser - accept the self-signed certificate warning, then sign in as nagiosadmin with the password from step 4. The browser asks for it with a standard HTTP authentication prompt.
    6. The local host is already monitored (load, disk, users, processes, SSH and the web server). Add your own hosts and services by creating a file under /usr/local/nagios/etc/objects/ and referencing it from /usr/local/nagios/etc/nagios.cfg with a cfg_file= line.
    7. Check the configuration, then reload: sudo /usr/local/nagios/bin/nagios -v /usr/local/nagios/etc/nagios.cfg sudo systemctl reload nagios

    The web password is generated on your instance at first launch and is stored only as a bcrypt hash. Credentials are saved to /root/nagios-credentials.txt. Check plugins are installed in /usr/local/nagios/libexec - run any of them with --help to see its options. Check state is held in flat files under /usr/local/nagios/var and survives a reboot; there is no database to administer. No mail transport is installed - install one (for example msmtp-mta) and point it at your relay before enabling email notifications. Replace the self-signed TLS certificate with a CA-signed certificate for production use. Certbot validates over HTTP, so TCP 80 must be reachable from the internet while the command runs: sudo certbot --nginx -d yourdomain.com

    Resources

    Vendor resources

    Support

    Vendor support

    Visit us online: https://lynxroute.com 

    For Nagios Core documentation:

    AWS infrastructure support

    AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.

    Similar products

    Customer reviews

    Ratings and reviews

     Info
    0 ratings
    5 star
    4 star
    3 star
    2 star
    1 star
    0%
    0%
    0%
    0%
    0%
    0 reviews
    No customer reviews yet
    Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.