Sold by: Lynxroute
Deployed on AWS
Free Trial
This product has charges associated with it for hardening, security configuration, and support.
Checkmk Community Edition is a self-contained infrastructure and application monitoring server: one package carries its own web server, Python runtime, cache, message broker and time-series storage, with agent-based and agentless checks for several hundred technologies. This Lynxroute build is hardened and ready out of the box: the monitoring site and every one of its keys is generated on your own instance at first boot, all site listeners are pinned to loopback behind an nginx TLS perimeter, the Checkmk agent is installed ready for the first host, UFW firewall pre-configured, and a CIS Level 1 hardened Ubuntu 24.04 LTS base.
GPL-2.0 license - fully auditable, no vendor lock-in.
Overview
This is a repackaged software product wherein additional charges apply for hardening, security configuration, and support.
WHAT IS CHECKMK COMMUNITY EDITION
Checkmk Community Edition is the free, GPL-2.0 edition of Checkmk, a monitoring system for servers, applications, networks, cloud services and containers. It is distributed as a self-contained stack: a single package brings its own Apache, Python runtime, Redis cache, RabbitMQ message broker, RRD time-series storage and monitoring core, so nothing has to be assembled from separate services. Monitoring is agent-based or agentless, and the service discovery is the point of the product: install the agent on a host, run a discovery, and Checkmk proposes the services it found rather than making you declare them. Several hundred official check plug-ins cover Linux, Windows, VMware, Kubernetes, databases, network hardware via SNMP, and the major cloud APIs. Configuration is done in the web UI with an explicit Activate-changes step, and a REST API covers the same operations for automation. GPL-2.0 license, no vendor lock-in.
WHAT THIS AMI ADDS
Security hardening:
- The monitoring site is created on YOUR instance at first boot, not baked into the image - so its certificate authority, session-signing secret, automation secret and admin password are unique to your instance and exist nowhere else
- Admin password generated at first boot and written to a root-only credentials file
- Every site listener pinned to loopback - the site web server, the system web server and the message broker are reachable only from the instance itself, with nginx terminating TLS on 443 in front of them
- The message broker's shipped default listens on all interfaces; this build overrides it to 127.0.0.1
- Self-signed certificate out of the box and Certbot pre-installed, so a CA-signed certificate is one command away
- Unused listening services that arrive as package dependencies are masked
- UFW firewall pre-configured - SSH 22 and HTTPS 443; port 80 only redirects to HTTPS and carries the certificate-issuance challenge
- fail2ban, AppArmor
- CVE scan - every image is scanned for vulnerabilities before release
Ready to use on first login:
- The Checkmk agent is installed on this server, so adding it as your first host takes three clicks and service discovery finds its services immediately
OS hardening (CIS Level 1):
- CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
- auditd, SSH hardening, Kernel hardening, IMDSv2 enforced
Compliance artifacts:
- SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
- CIS Conformance Report at /etc/lynxroute/cis-report.html
- CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
Highlights
- Checkmk security baked in: the monitoring site and all of its keys are generated on your own instance at first boot rather than shipped in the image, so no two instances share a certificate authority or session secret; every site listener including the message broker is pinned to loopback behind an nginx TLS perimeter; UFW firewall pre-configured.
- CIS Level 1 hardened Ubuntu 24.04 LTS: auditd, fail2ban, AppArmor, SSH key-only, IMDSv2 enforced. CVE-scanned before every release. SBOM (CycloneDX) and CIS Conformance Report included.
- Monitoring that configures itself: service discovery proposes what to watch instead of making you declare it, with several hundred official check plug-ins for Linux, Windows, VMware, Kubernetes, databases and SNMP network hardware. GPL-2.0 license - fully auditable, no vendor lock-in.
Details
Sold by
Categories
Delivery method
Delivery option
64-bit (x86) Amazon Machine Image (AMI)
Latest version
Operating system
Ubuntu 24.04
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Free trial
Try this product free for 5 days according to the free trial terms set by the vendor. Usage-based pricing is in effect for usage beyond the free trial terms. Your free trial gets automatically converted to a paid subscription when the trial ends, but may be canceled any time before that.
Pricing is based on actual usage, with charges varying according to how much you consume. Subscriptions have no end date and may be canceled any time.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Cost/hour |
|---|---|
t3.large Recommended | $0.05 |
t3.medium | $0.03 |
m6i.xlarge | $0.05 |
m6i.large | $0.05 |
Vendor refund policy
We do not offer refunds for this product. AWS infrastructure charges (EC2, EBS, data transfer) are billed separately by AWS and are not refundable by us.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
64-bit (x86) Amazon Machine Image (AMI)
Amazon Machine Image (AMI)
An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.
Version release notes
Checkmk Community Edition 2.5.0p10 - Initial release (August 2026)
- Checkmk Community Edition 2.5.0p10 on Ubuntu 24.04 LTS
- CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)
- CVE-scanned before every release
- The monitoring site is created on the instance at first boot, so its certificate authority, session secret, automation secret and admin password are unique per instance
- Site web server, system web server and message broker all pinned to loopback
- nginx TLS perimeter on 443 with a self-signed certificate plus Certbot for one-command CA-signed TLS
- The Checkmk agent is installed on the server itself, so the first host you add is discovered immediately
- UFW firewall pre-configured (SSH 22, HTTPS 443, and port 80 for the HTTPS redirect and certificate issuance)
- fail2ban, auditd, AppArmor pre-configured
- SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json
- CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html
- IMDSv2 enforced
Additional details
Usage instructions
- Launch instance (t3.medium minimum, t3.large recommended)
- Open Security Group - allow TCP 443 from your IP (and TCP 80 if you will use certbot)
- SSH: ssh -i key.pem ubuntu@<PUBLIC_IP>
- Read credentials: sudo cat /root/checkmk-credentials.txt
- Open https://<PUBLIC_IP>/ in your browser - accept the self-signed certificate warning, then sign in as cmkadmin with the password from step 4
- Add this server as your first host: Setup, Hosts, Add host; name it with its own hostname and address 127.0.0.1, then save and run the service discovery, then Activate changes. Its agent is already installed, so discovery finds its services immediately
- Add your other hosts the same way - download the agent for each from Setup, Agents inside the UI
First launch takes 2-4 minutes: the monitoring site is created on your own instance so that its certificate authority, session secret and automation secret are unique to you. Until it is ready the page shows a "Starting up" screen that refreshes itself. The admin password is generated on your instance at first launch and saved to /root/checkmk-credentials.txt. Agents in pull mode need no inbound port on this server - it connects out to the agent on TCP 6556. Registering an agent for TLS contacts this server on TCP 8000, which is closed by default; open it only for the networks that need it. Site administration uses the omd command: sudo omd status cmk, sudo omd stop cmk, sudo omd start cmk. Back up with sudo omd backup cmk /var/tmp/cmk-backup.tar.gz Replace the self-signed TLS certificate with a CA-signed certificate for production use. Certbot validates over HTTP, so TCP 80 must be reachable from the internet while the command runs: sudo certbot --nginx -d yourdomain.com
Resources
Vendor resources
Support
Vendor support
Visit us online: https://lynxroute.com
For Checkmk documentation:
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.