[{"data":1,"prerenderedAt":1289},["ShallowReactive",2],{"docs-navigation":3,"doc-\u002Fserver-monitoring\u002Fsecurity":434},[4,22,104,157,194,211,224,265,302,335,364,380,397,414],{"title":5,"path":6,"stem":7,"children":8,"page":21},"Erste Schritte","\u002Fgetting-started","01.getting-started",[9,13,17],{"title":10,"path":11,"stem":12},"Was ist LIVCK Cloud?","\u002Fgetting-started\u002Fwhat-is-livck","01.getting-started\u002F01.what-is-livck",{"title":14,"path":15,"stem":16},"Schnellstart","\u002Fgetting-started\u002Fquickstart","01.getting-started\u002F02.quickstart",{"title":18,"path":19,"stem":20},"Das Dashboard","\u002Fgetting-started\u002Fdashboard","01.getting-started\u002F03.dashboard",false,{"title":23,"path":24,"stem":25,"children":26,"page":21},"Monitoring","\u002Fmonitoring","02.monitoring",[27,31,64,68,72,76,80,84,88,92,96,100],{"title":28,"path":29,"stem":30},"Services verwalten","\u002Fmonitoring\u002Fservices","02.monitoring\u002F01.services",{"title":32,"path":33,"stem":34,"children":35,"page":21},"Check-Typen","\u002Fmonitoring\u002Fchecks","02.monitoring\u002F02.checks",[36,40,44,48,52,56,60],{"title":37,"path":38,"stem":39},"HTTP\u002FHTTPS-Checks","\u002Fmonitoring\u002Fchecks\u002Fhttp","02.monitoring\u002F02.checks\u002F01.http",{"title":41,"path":42,"stem":43},"TCP-Port-Checks","\u002Fmonitoring\u002Fchecks\u002Ftcp","02.monitoring\u002F02.checks\u002F02.tcp",{"title":45,"path":46,"stem":47},"DNS-Checks","\u002Fmonitoring\u002Fchecks\u002Fdns","02.monitoring\u002F02.checks\u002F03.dns",{"title":49,"path":50,"stem":51},"Ping-Checks (ICMP)","\u002Fmonitoring\u002Fchecks\u002Ficmp","02.monitoring\u002F02.checks\u002F04.icmp",{"title":53,"path":54,"stem":55},"SSL-Zertifikat-Checks","\u002Fmonitoring\u002Fchecks\u002Fssl","02.monitoring\u002F02.checks\u002F05.ssl",{"title":57,"path":58,"stem":59},"Heartbeat-Checks (Push-Monitoring)","\u002Fmonitoring\u002Fchecks\u002Fheartbeat","02.monitoring\u002F02.checks\u002F06.heartbeat",{"title":61,"path":62,"stem":63},"Manuelle Services","\u002Fmonitoring\u002Fchecks\u002Fmanual","02.monitoring\u002F02.checks\u002F07.manual",{"title":65,"path":66,"stem":67},"Check-Einstellungen","\u002Fmonitoring\u002Fcheck-settings","02.monitoring\u002F03.check-settings",{"title":69,"path":70,"stem":71},"Bedingungen","\u002Fmonitoring\u002Fconditions","02.monitoring\u002F04.conditions",{"title":73,"path":74,"stem":75},"Monitoring-Standorte","\u002Fmonitoring\u002Flocations","02.monitoring\u002F05.locations",{"title":77,"path":78,"stem":79},"Service-Detailseite","\u002Fmonitoring\u002Fservice-detail","02.monitoring\u002F06.service-detail",{"title":81,"path":82,"stem":83},"Artifacts","\u002Fmonitoring\u002Fartifacts","02.monitoring\u002F07.artifacts",{"title":85,"path":86,"stem":87},"Status überschreiben","\u002Fmonitoring\u002Fstatus-override","02.monitoring\u002F08.status-override",{"title":89,"path":90,"stem":91},"Eigene Zertifikate (mTLS & private CAs)","\u002Fmonitoring\u002Fcertificates","02.monitoring\u002F09.certificates",{"title":93,"path":94,"stem":95},"Tags","\u002Fmonitoring\u002Ftags","02.monitoring\u002F10.tags",{"title":97,"path":98,"stem":99},"Sync-Quellen","\u002Fmonitoring\u002Fsync-sources","02.monitoring\u002F11.sync-sources",{"title":101,"path":102,"stem":103},"CDN & WAF-Integration","\u002Fmonitoring\u002Fcdn-waf-integration","02.monitoring\u002F12.cdn-waf-integration",{"title":105,"path":106,"stem":107,"children":108,"page":21},"Server-Monitoring","\u002Fserver-monitoring","03.server-monitoring",[109,113,117,121,125,129,133,137,141,145,149,153],{"title":110,"path":111,"stem":112},"Überblick","\u002Fserver-monitoring\u002Foverview","03.server-monitoring\u002F01.overview",{"title":114,"path":115,"stem":116},"Agent installieren","\u002Fserver-monitoring\u002Finstallation","03.server-monitoring\u002F02.installation",{"title":118,"path":119,"stem":120},"Sicherheit & Transparenz","\u002Fserver-monitoring\u002Fsecurity","03.server-monitoring\u002F03.security",{"title":122,"path":123,"stem":124},"Was gemessen wird","\u002Fserver-monitoring\u002Fmetrics","03.server-monitoring\u002F04.metrics",{"title":126,"path":127,"stem":128},"Serverliste & Detailansicht","\u002Fserver-monitoring\u002Fservers","03.server-monitoring\u002F05.servers",{"title":130,"path":131,"stem":132},"Alarm-Regeln","\u002Fserver-monitoring\u002Falert-rules","03.server-monitoring\u002F06.alert-rules",{"title":134,"path":135,"stem":136},"Ereignisse & Benachrichtigungen","\u002Fserver-monitoring\u002Fevents","03.server-monitoring\u002F07.events",{"title":138,"path":139,"stem":140},"Erreichbarkeits-Prüfungen","\u002Fserver-monitoring\u002Freachability","03.server-monitoring\u002F08.reachability",{"title":142,"path":143,"stem":144},"Agent-Updates","\u002Fserver-monitoring\u002Fupdates","03.server-monitoring\u002F09.updates",{"title":146,"path":147,"stem":148},"Auf der Statuspage zeigen","\u002Fserver-monitoring\u002Fstatuspage","03.server-monitoring\u002F10.statuspage",{"title":150,"path":151,"stem":152},"Grenzen & Pläne","\u002Fserver-monitoring\u002Flimits","03.server-monitoring\u002F11.limits",{"title":154,"path":155,"stem":156},"Fehlerbehebung","\u002Fserver-monitoring\u002Ftroubleshooting","03.server-monitoring\u002F12.troubleshooting",{"title":158,"path":159,"stem":160,"children":161,"page":21},"Incidents","\u002Fincidents","04.incidents",[162,166,170,174,178,182,186,190],{"title":163,"path":164,"stem":165},"Incidents verstehen","\u002Fincidents\u002Foverview","04.incidents\u002F01.overview",{"title":167,"path":168,"stem":169},"Incident erstellen","\u002Fincidents\u002Fcreate-incident","04.incidents\u002F02.create-incident",{"title":171,"path":172,"stem":173},"Incident verwalten","\u002Fincidents\u002Fmanage-incident","04.incidents\u002F03.manage-incident",{"title":175,"path":176,"stem":177},"Automatische Erkennung","\u002Fincidents\u002Fauto-detection","04.incidents\u002F04.auto-detection",{"title":179,"path":180,"stem":181},"Interne Kommentare","\u002Fincidents\u002Fincident-comments","04.incidents\u002F05.incident-comments",{"title":183,"path":184,"stem":185},"Postmortems","\u002Fincidents\u002Fpostmortems","04.incidents\u002F06.postmortems",{"title":187,"path":188,"stem":189},"Incident-Richtlinien","\u002Fincidents\u002Fincident-policies","04.incidents\u002F07.incident-policies",{"title":191,"path":192,"stem":193},"Incident-Vorlagen","\u002Fincidents\u002Fincident-templates","04.incidents\u002F08.incident-templates",{"title":195,"path":196,"stem":197,"children":198,"page":21},"Eskalation","\u002Fescalation","05.escalation",[199,203,207],{"title":200,"path":201,"stem":202},"Eskalationsrichtlinien","\u002Fescalation\u002Fpolicies","05.escalation\u002F01.policies",{"title":204,"path":205,"stem":206},"Eskalation während eines Incidents","\u002Fescalation\u002Fduring-incident","05.escalation\u002F02.during-incident",{"title":208,"path":209,"stem":210},"Betriebszeiten (On-Call)","\u002Fescalation\u002Foperating-schedules","05.escalation\u002F03.operating-schedules",{"title":212,"path":213,"stem":214,"children":215,"page":21},"Wartungen","\u002Fmaintenance","06.maintenance",[216,220],{"title":217,"path":218,"stem":219},"Wartungen planen","\u002Fmaintenance\u002Foverview","06.maintenance\u002F01.overview",{"title":221,"path":222,"stem":223},"Wartungs-Benachrichtigungen","\u002Fmaintenance\u002Fnotifications","06.maintenance\u002F02.notifications",{"title":225,"path":226,"stem":227,"children":228,"page":21},"Statuspages","\u002Fstatuspages","07.statuspages",[229,233,237,241,245,249,253,257,261],{"title":230,"path":231,"stem":232},"Statuspages verstehen","\u002Fstatuspages\u002Foverview","07.statuspages\u002F01.overview",{"title":234,"path":235,"stem":236},"Statuspage erstellen","\u002Fstatuspages\u002Fcreate-statuspage","07.statuspages\u002F02.create-statuspage",{"title":238,"path":239,"stem":240},"Zugriffskontrolle","\u002Fstatuspages\u002Faccess-control","07.statuspages\u002F03.access-control",{"title":242,"path":243,"stem":244},"Komponenten verwalten","\u002Fstatuspages\u002Fcomponents","07.statuspages\u002F04.components",{"title":246,"path":247,"stem":248},"Abonnenten (Subscriber)","\u002Fstatuspages\u002Fsubscribers","07.statuspages\u002F05.subscribers",{"title":250,"path":251,"stem":252},"Custom Domains","\u002Fstatuspages\u002Fcustom-domains","07.statuspages\u002F06.custom-domains",{"title":254,"path":255,"stem":256},"Öffentliche Ansicht","\u002Fstatuspages\u002Fpublic-view","07.statuspages\u002F07.public-view",{"title":258,"path":259,"stem":260},"Layout-Builder","\u002Fstatuspages\u002Flayout-builder","07.statuspages\u002F08.layout-builder",{"title":262,"path":263,"stem":264},"Metriken","\u002Fstatuspages\u002Fmetrics","07.statuspages\u002F09.metrics",{"title":266,"path":267,"stem":268,"children":269,"page":21},"Team & Organisation","\u002Fteam","08.team",[270,274,278,282,286,290,294,298],{"title":271,"path":272,"stem":273},"Organisationen","\u002Fteam\u002Forganizations","08.team\u002F01.organizations",{"title":275,"path":276,"stem":277},"Mitglieder verwalten","\u002Fteam\u002Fmembers","08.team\u002F02.members",{"title":279,"path":280,"stem":281},"Rollen & Berechtigungen","\u002Fteam\u002Froles","08.team\u002F03.roles",{"title":283,"path":284,"stem":285},"Teams","\u002Fteam\u002Fteams","08.team\u002F04.teams",{"title":287,"path":288,"stem":289},"Einladungen","\u002Fteam\u002Finvitations","08.team\u002F05.invitations",{"title":291,"path":292,"stem":293},"Enterprise SSO (Single Sign-On)","\u002Fteam\u002Fsso","08.team\u002F06.sso",{"title":295,"path":296,"stem":297},"Entra ID (Azure AD) einrichten","\u002Fteam\u002Fsso-entra","08.team\u002F07.sso-entra",{"title":299,"path":300,"stem":301},"Keycloak einrichten","\u002Fteam\u002Fsso-keycloak","08.team\u002F08.sso-keycloak",{"title":303,"path":304,"stem":305,"children":306,"page":21},"Abrechnung","\u002Fbilling","09.billing",[307,311,315,319,323,327,331],{"title":308,"path":309,"stem":310},"Pläne & Preise","\u002Fbilling\u002Fplans","09.billing\u002F01.plans",{"title":312,"path":313,"stem":314},"Plan wechseln","\u002Fbilling\u002Fupgrade-downgrade","09.billing\u002F02.upgrade-downgrade",{"title":316,"path":317,"stem":318},"Zahlungsmethoden","\u002Fbilling\u002Fpayment","09.billing\u002F03.payment",{"title":320,"path":321,"stem":322},"Rechnungen","\u002Fbilling\u002Finvoices","09.billing\u002F04.invoices",{"title":324,"path":325,"stem":326},"SMS- & Voice-Guthaben","\u002Fbilling\u002Fsms-credits","09.billing\u002F05.sms-credits",{"title":328,"path":329,"stem":330},"Plan-Limits","\u002Fbilling\u002Flimits","09.billing\u002F06.limits",{"title":332,"path":333,"stem":334},"Add-Ons","\u002Fbilling\u002Fadd-ons","09.billing\u002F07.add-ons",{"title":336,"path":337,"stem":338,"children":339,"page":21},"Account & Sicherheit","\u002Faccount","10.account",[340,344,348,352,356,360],{"title":341,"path":342,"stem":343},"Profil bearbeiten","\u002Faccount\u002Fprofile","10.account\u002F01.profile",{"title":345,"path":346,"stem":347},"Passwort ändern","\u002Faccount\u002Fpassword","10.account\u002F02.password",{"title":349,"path":350,"stem":351},"Anmelden mit Google, GitHub & Discord","\u002Faccount\u002Fsocial-login","10.account\u002F03.social-login",{"title":353,"path":354,"stem":355},"Zwei-Faktor-Authentifizierung","\u002Faccount\u002Ftwo-factor","10.account\u002F04.two-factor",{"title":357,"path":358,"stem":359},"Account löschen","\u002Faccount\u002Fdelete-account","10.account\u002F05.delete-account",{"title":361,"path":362,"stem":363},"Erscheinungsbild","\u002Faccount\u002Fappearance","10.account\u002F06.appearance",{"title":365,"path":366,"stem":367,"children":368,"page":21},"Benachrichtigungen","\u002Fnotifications","11.notifications",[369,372,376],{"title":365,"path":370,"stem":371},"\u002Fnotifications\u002Foverview","11.notifications\u002F01.overview",{"title":373,"path":374,"stem":375},"Benachrichtigungskanäle","\u002Fnotifications\u002Fchannels","11.notifications\u002F02.channels",{"title":377,"path":378,"stem":379},"Persönliche Benachrichtigungs-Einstellungen","\u002Fnotifications\u002Fpreferences","11.notifications\u002F03.preferences",{"title":381,"path":382,"stem":383,"children":384,"page":21},"API","\u002Fapi","12.api",[385,389,393],{"title":386,"path":387,"stem":388},"API-Übersicht","\u002Fapi\u002Foverview","12.api\u002F01.overview",{"title":390,"path":391,"stem":392},"API-Tokens","\u002Fapi\u002Ftokens","12.api\u002F02.tokens",{"title":394,"path":395,"stem":396},"API-Endpunkte","\u002Fapi\u002Fendpoints","12.api\u002F03.endpoints",{"title":398,"path":399,"stem":400,"children":401,"page":21},"SLA","\u002Fsla","13.sla",[402,406,410],{"title":403,"path":404,"stem":405},"SLA-Monitoring","\u002Fsla\u002Foverview","13.sla\u002F01.overview",{"title":407,"path":408,"stem":409},"SLA-Ziele","\u002Fsla\u002Fobjectives","13.sla\u002F02.objectives",{"title":411,"path":412,"stem":413},"SLA-Reports","\u002Fsla\u002Freports","13.sla\u002F03.reports",{"title":415,"path":416,"stem":417,"children":418,"page":21},"FAQ","\u002Ffaq","14.faq",[419,423,427,431],{"title":420,"path":421,"stem":422},"Allgemeine Fragen","\u002Ffaq\u002Fgeneral","14.faq\u002F01.general",{"title":424,"path":425,"stem":426},"Häufige Fragen zum Monitoring","\u002Ffaq\u002Fmonitoring-faq","14.faq\u002F02.monitoring-faq",{"title":428,"path":429,"stem":430},"Häufige Fragen zur Abrechnung","\u002Ffaq\u002Fbilling-faq","14.faq\u002F03.billing-faq",{"title":154,"path":432,"stem":433},"\u002Ffaq\u002Ftroubleshooting","14.faq\u002F04.troubleshooting",{"id":435,"title":118,"body":436,"description":1283,"extension":1284,"meta":1285,"navigation":1286,"path":119,"seo":1287,"stem":120,"__hash__":1288},"docs\u002F03.server-monitoring\u002F03.security.md",{"type":437,"value":438,"toc":1265},"minimark",[439,443,447,452,455,469,472,476,481,493,496,562,569,573,580,587,590,606,609,624,628,649,652,761,771,779,783,794,799,887,892,937,951,955,981,985,992,1017,1039,1043,1066,1072,1076,1079,1179,1183,1186,1236,1239,1243],[440,441,118],"h1",{"id":442},"sicherheit-transparenz",[444,445,446],"p",{},"Software auf einem Produktivserver zu installieren ist eine Vertrauensfrage. Diese Seite beantwortet sie so, dass du sie nachprüfen kannst -- nicht mit Versprechen, sondern mit Fakten, die im offenen Quellcode nachlesbar sind.",[448,449,451],"h2",{"id":450},"der-agent-ist-open-source","Der Agent ist Open Source",[444,453,454],{},"Der komplette Quellcode liegt öffentlich auf GitHub:",[444,456,457,468],{},[458,459,460],"strong",{},[461,462,467],"a",{"href":463,"rel":464,"target":466},"https:\u002F\u002Fgithub.com\u002FLIVCK\u002Fagent",[465],"nofollow","_blank","github.com\u002FLIVCK\u002Fagent"," -- MIT-Lizenz",[444,470,471],{},"Du kannst ihn lesen, prüfen, selbst kompilieren und mit dem ausgelieferten Paket vergleichen. Er ist in Go geschrieben und wird als statische Datei ohne externe Abhängigkeiten und ohne Plugin-Mechanismus gebaut -- es gibt keinen Weg, zur Laufzeit fremden Code nachzuladen.",[448,473,475],{"id":474},"die-vier-kernzusagen","Die vier Kernzusagen",[477,478,480],"h3",{"id":479},"_1-nur-ausgehende-verbindungen-kein-offener-port","1. Nur ausgehende Verbindungen -- kein offener Port",[444,482,483,484,487,488,492],{},"Der Agent ",[458,485,486],{},"öffnet keinen Netzwerk-Port",". Weder nach außen, noch auf ",[489,490,491],"code",{},"localhost",", noch als lokalen Socket. Es gibt im Quellcode keine einzige Stelle, die auf eingehende Verbindungen lauscht.",[444,494,495],{},"Alle Kommunikation geht in eine Richtung: vom Server zu LIVCK, ausschließlich über HTTPS auf Port 443.",[497,498,499,515],"table",{},[500,501,502],"thead",{},[503,504,505,509,512],"tr",{},[506,507,508],"th",{},"Ziel",[506,510,511],{},"Wofür",[506,513,514],{},"Wie oft",[516,517,518,532,545],"tbody",{},[503,519,520,526,529],{},[521,522,523],"td",{},[489,524,525],{},"app.livck.cloud",[521,527,528],{},"Anmeldung, Abholen der Messkonfiguration",[521,530,531],{},"bei der Installation, danach spätestens alle 5 Minuten",[503,533,534,539,542],{},[521,535,536],{},[489,537,538],{},"ingest.livck.cloud",[521,540,541],{},"Übertragung der Messwerte und Ereignisse",[521,543,544],{},"im eingestellten Report-Intervall (je nach Plan ab 30 Sekunden)",[503,546,547,552,555],{},[521,548,549],{},[489,550,551],{},"get.livck.cloud",[521,553,554],{},"Herunterladen neuer Agent-Versionen",[521,556,557,558,561],{},"nur wenn ein ",[461,559,560],{"href":143},"Update"," ansteht",[444,563,564,565,568],{},"In deiner Firewall musst du ",[458,566,567],{},"nichts eingehend freigeben",". Für ausgehende Verbindungen genügt Port 443 zu diesen drei Hosts; ein HTTP-Proxy wird unterstützt.",[477,570,572],{"id":571},"_2-kein-kommando-kanal-keine-fernsteuerung","2. Kein Kommando-Kanal -- keine Fernsteuerung",[444,574,575,576,579],{},"LIVCK kann auf deinem Server ",[458,577,578],{},"nichts ausführen",". Das ist keine deaktivierte Funktion, sondern eine, die es nicht gibt: Im Protokoll zwischen Agent und LIVCK existiert kein Feld für Befehle, Skripte, Pfade oder Shell-Kommandos.",[444,581,582,583,586],{},"Die Konfiguration, die der Agent abholt, beschreibt ausschließlich, ",[458,584,585],{},"was gemessen werden soll"," -- welche Messwerte, in welchem Takt, welche Erreichbarkeitsziele. Sie kann nicht beschreiben, was ausgeführt werden soll.",[444,588,589],{},"Der Agent startet im laufenden Betrieb genau zwei fremde Programme, und zwar nur dann, wenn sie bereits auf dem System vorhanden sind, mit fest einkompilierten Argumenten:",[591,592,593,600],"ul",{},[594,595,596,599],"li",{},[489,597,598],{},"nvidia-smi"," -- zum Auslesen der GPU-Werte",[594,601,602,605],{},[489,603,604],{},"smartctl"," -- zum Auslesen der SMART-Werte deiner Laufwerke",[444,607,608],{},"Keines der beiden wird vom Agenten installiert, und keines nimmt Werte aus der Konfiguration entgegen.",[610,611,614],"callout",{"title":612,"type":613},"Und der Update-Mechanismus?","info",[444,615,616,617,620,621],{},"Die einzige Stelle, an der neuer Code auf deinen Server kommt, ist das ",[461,618,619],{"href":143},"Agent-Update",". Dieser Weg ist bewusst eng: nur HTTPS, nur mit erzwungener SHA-256-Prüfung, keine Downgrades, ein Test der neuen Datei als unprivilegierter Benutzer -- und ein automatischer Rückfall auf die alte Version, wenn der Dienst danach nicht sauber läuft. Wenn du auch das nicht willst, deaktivierst du automatische Updates: ",[489,622,623],{},"sudo systemctl disable --now livck-agent-update.timer",[477,625,627],{"id":626},"_3-kein-root-und-praktisch-keine-rechte","3. Kein Root -- und praktisch keine Rechte",[444,629,630,631,636,637,640,641,644,645,648],{},"Der Dienst läuft unter dem eigens angelegten Systembenutzer ",[458,632,633],{},[489,634,635],{},"livck-agent"," mit Shell ",[489,638,639],{},"nologin",". Er läuft ",[458,642,643],{},"nicht"," als ",[489,646,647],{},"root",".",[444,650,651],{},"Zusätzlich ist die systemd-Unit gehärtet. Die wichtigsten Punkte:",[497,653,654,664],{},[500,655,656],{},[503,657,658,661],{},[506,659,660],{},"Einstellung",[506,662,663],{},"Wirkung",[516,665,666,680,690,700,717,727,741,751],{},[503,667,668,674],{},[521,669,670,673],{},[489,671,672],{},"CapabilityBoundingSet="," (leer)",[521,675,676,679],{},[458,677,678],{},"Alle"," Linux-Capabilities entzogen -- keine einzige",[503,681,682,687],{},[521,683,684],{},[489,685,686],{},"NoNewPrivileges=yes",[521,688,689],{},"Rechte können nicht nachträglich erlangt werden",[503,691,692,697],{},[521,693,694],{},[489,695,696],{},"ProtectSystem=strict",[521,698,699],{},"Das gesamte Dateisystem ist schreibgeschützt; geschrieben wird nur ins eigene Verzeichnis",[503,701,702,707],{},[521,703,704],{},[489,705,706],{},"ProtectHome=read-only",[521,708,709,712,713,716],{},[489,710,711],{},"\u002Fhome"," und ",[489,714,715],{},"\u002Froot"," sind lesbar, aber nicht beschreibbar",[503,718,719,724],{},[521,720,721],{},[489,722,723],{},"MemoryDenyWriteExecute=yes",[521,725,726],{},"Kein Speicherbereich ist gleichzeitig beschreib- und ausführbar",[503,728,729,738],{},[521,730,731,734,735],{},[489,732,733],{},"ProtectKernelTunables"," \u002F ",[489,736,737],{},"ProtectKernelModules",[521,739,740],{},"Kernel-Parameter und -Module sind tabu",[503,742,743,748],{},[521,744,745],{},[489,746,747],{},"SystemCallFilter=@system-service",[521,749,750],{},"Nur die Systemaufrufe eines gewöhnlichen Dienstes sind erlaubt",[503,752,753,758],{},[521,754,755],{},[489,756,757],{},"RestrictAddressFamilies",[521,759,760],{},"Nur die Socket-Typen, die für ausgehendes HTTPS nötig sind",[444,762,763,764,712,767,770],{},"Auch der Ressourcenverbrauch ist hart gedeckelt: höchstens ",[458,765,766],{},"64 MB Arbeitsspeicher",[458,768,769],{},"40 % eines einzelnen CPU-Kerns",", unabhängig davon, wie groß der Server ist. Im Normalbetrieb liegt der Verbrauch weit darunter. Überschreitet der Agent das Speicherlimit, beendet ihn der Kernel -- dein Server bleibt davon unberührt.",[444,772,773,774,648],{},"Die vollständige Unit-Datei mit Begründung zu jeder einzelnen Zeile liegt im ",[461,775,778],{"href":776,"rel":777,"target":466},"https:\u002F\u002Fgithub.com\u002FLIVCK\u002Fagent\u002Fblob\u002Fmain\u002Fpackaging\u002Fsystemd\u002Flivck-agent.service",[465],"Repository",[477,780,782],{"id":781},"_4-nur-kennzahlen-keine-inhalte","4. Nur Kennzahlen -- keine Inhalte",[444,784,785,786,789,790,793],{},"Der Agent liest ausschließlich Kennzahlen aus den Statistik-Schnittstellen des Kernels (",[489,787,788],{},"\u002Fproc",", ",[489,791,792],{},"\u002Fsys",") und die Belegung eingehängter Dateisysteme.",[444,795,796],{},[458,797,798],{},"Was übertragen wird:",[497,800,801,811],{},[500,802,803],{},[503,804,805,808],{},[506,806,807],{},"Kategorie",[506,809,810],{},"Beispiele",[516,812,813,821,829,837,845,868,876],{},[503,814,815,818],{},[521,816,817],{},"Systemmetriken",[521,819,820],{},"CPU, Arbeitsspeicher, Swap, Last, Ressourcen-Druck, Prozessanzahl, Laufzeit",[503,822,823,826],{},[521,824,825],{},"Speicher & Netzwerk",[521,827,828],{},"Belegung je Einhängepunkt, Durchsatz je Laufwerk, Durchsatz und Fehler je Netzwerkschnittstelle",[503,830,831,834],{},[521,832,833],{},"Hardware",[521,835,836],{},"GPU-Auslastung und -Temperatur, SMART-Werte, jeweils falls verfügbar",[503,838,839,842],{},[521,840,841],{},"Server-Steckbrief",[521,843,844],{},"Hostname, Betriebssystem und Version, Kernel, Architektur, CPU-Modell, Anzahl Kerne, RAM-Größe, Startzeitpunkt",[503,846,847,850],{},[521,848,849],{},"Bezeichner",[521,851,852,853,789,856,859,860,863,864,867],{},"Namen von Einhängepunkten (z.B. ",[489,854,855],{},"\u002F",[489,857,858],{},"\u002Fvar","), Netzwerkschnittstellen (z.B. ",[489,861,862],{},"eth0","), Laufwerken (z.B. ",[489,865,866],{},"nvme0n1","), GPU- und Laufwerksmodell",[503,869,870,873],{},[521,871,872],{},"Ereignisse",[521,874,875],{},"Neustarts, saubere Abschaltungen, Out-of-Memory-Kills, volle oder schreibgeschützte Dateisysteme",[503,877,878,881],{},[521,879,880],{},"Private IP-Adressen",[521,882,883,886],{},[458,884,885],{},"einmalig bei der Anmeldung",", als Inventarangabe -- danach nie wieder",[444,888,889],{},[458,890,891],{},"Was ausdrücklich nicht gelesen und nicht übertragen wird:",[591,893,894,908,914,920,925,931],{},[594,895,896,897,900,901,904,905],{},"Keine ",[458,898,899],{},"Logdateien"," -- weder Journald, noch ",[489,902,903],{},"\u002Fvar\u002Flog",", noch ",[489,906,907],{},"dmesg",[594,909,896,910,913],{},[458,911,912],{},"Dateiinhalte"," deiner Anwendungen oder Nutzer",[594,915,896,916,919],{},[458,917,918],{},"Prozessnamen, Kommandozeilen oder Umgebungsvariablen"," -- der Agent zählt Prozesse, mehr nicht",[594,921,896,922],{},[458,923,924],{},"Benutzerkonten, Logins oder Sitzungsdaten",[594,926,896,927,930],{},[458,928,929],{},"Verzeichnislisten"," deiner Daten",[594,932,896,933,936],{},[458,934,935],{},"öffentlichen IP-Adressen",", keine Nutzungstelemetrie",[610,938,941],{"title":939,"type":940},"Einhängepunkte sind Namen","warning",[444,942,943,944,946,947,950],{},"Damit LIVCK dir „",[489,945,858],{}," ist zu 92 % voll\" anzeigen kann, muss der Pfad des Einhängepunkts mitübertragen werden. Heißt eine Partition bei dir z.B. ",[489,948,949],{},"\u002Fsrv\u002Fkunde-mueller",", steht dieser Name in den Messreihen. Das ist die einzige Stelle, an der ein selbstgewählter Pfad LIVCK erreicht -- wähle Einhängepunkte entsprechend, wenn sie Kundennamen enthalten könnten.",[448,952,954],{"id":953},"verschlüsselung-und-zugangsdaten","Verschlüsselung und Zugangsdaten",[591,956,957,963,969,975],{},[594,958,959,962],{},[458,960,961],{},"Transport:"," Jede Verbindung läuft über TLS. Der Update-Mechanismus verweigert nicht-verschlüsselte Downloads und nicht-verschlüsselte Weiterleitungen ausdrücklich.",[594,964,965,968],{},[458,966,967],{},"Anmeldung:"," Der Enrollment-Token gilt nur für die Anmeldung, ist zeitlich befristet und in der Anzahl der Verwendungen begrenzt. LIVCK speichert ihn nur als Prüfsumme.",[594,970,971,974],{},[458,972,973],{},"Laufender Betrieb:"," Nach der Anmeldung bekommt jeder Server seinen eigenen Zugang, der ausschließlich für diesen einen Server gilt und den der Agent selbstständig turnusmäßig erneuert. Auf dem Server liegt er nur für den Dienstbenutzer lesbar.",[594,976,977,980],{},[458,978,979],{},"Live-Ansicht:"," Wenn du die Detailseite eines Servers öffnest, erhält dein Browser dafür ein Einmal-Ticket mit 30 Sekunden Gültigkeit. Zugangstoken landen nie im Browser.",[448,982,984],{"id":983},"herkunft-der-programmdatei","Herkunft der Programmdatei",[444,986,987,988,991],{},"Für jede veröffentlichte Version stellt LIVCK die Pakete und die statische Programmdatei zusammen mit einer ",[458,989,990],{},"SHA-256-Prüfsumme"," bereit.",[591,993,994,1001,1007],{},[594,995,996,997,1000],{},"Der ",[458,998,999],{},"Installer"," vergleicht die heruntergeladene Datei mit dieser Prüfsumme und bricht bei Abweichung ab.",[594,1002,996,1003,1006],{},[458,1004,1005],{},"Update-Mechanismus"," ist strenger: Fehlt die Prüfsumme, wird gar nicht erst aktualisiert.",[594,1008,1009,1010,789,1013,1016],{},"Die Programmdatei wird reproduzierbar gebaut (",[489,1011,1012],{},"CGO_ENABLED=0",[489,1014,1015],{},"-trimpath",") -- du kannst sie aus dem Quellcode selbst erzeugen und vergleichen.",[610,1018,1020],{"title":1019,"type":613},"Prüfsumme selbst kontrollieren",[444,1021,1022,1023,1026,1027,1029,1030,1035,1036,648],{},"Jedes Release-Artefakt hat eine passende ",[489,1024,1025],{},".sha256","-Datei auf ",[489,1028,551],{}," bzw. auf der ",[461,1031,1034],{"href":1032,"rel":1033,"target":466},"https:\u002F\u002Fgithub.com\u002FLIVCK\u002Fagent\u002Freleases",[465],"Releases-Seite",". Vergleiche sie vor einer manuellen Installation mit ",[489,1037,1038],{},"sha256sum",[448,1040,1042],{"id":1041},"datenschutz-und-hosting","Datenschutz und Hosting",[591,1044,1045,1052,1059],{},[594,1046,1047,1048,1051],{},"Die Messwerte werden ",[458,1049,1050],{},"in Deutschland"," verarbeitet und gespeichert, wie alle anderen LIVCK-Daten auch.",[594,1053,1054,1055,1058],{},"In den Messreihen landen ",[458,1056,1057],{},"keine IP-Adressen",". Die bei der Anmeldung erfassten privaten Adressen dienen als Inventarangabe zu deinem Server und werden mit der Organisation gelöscht.",[594,1060,1061,1062,1065],{},"Wie lange Server-Metriken aufbewahrt werden, richtet sich nach der ",[461,1063,1064],{"href":329},"Datenaufbewahrung"," deines Plans. Löschst du einen Server, werden seine Metriken und Ereignisse mitgelöscht.",[444,1067,1068,1069,648],{},"Mehr zum Thema unter ",[461,1070,1071],{"href":421},"Datenschutz",[448,1073,1075],{"id":1074},"zugriff-wieder-entziehen","Zugriff wieder entziehen",[444,1077,1078],{},"Du kannst die Verbindung jederzeit einseitig beenden -- LIVCK kann nichts dagegen tun:",[497,1080,1081,1090],{},[500,1082,1083],{},[503,1084,1085,1087],{},[506,1086,508],{},[506,1088,1089],{},"Vorgehen",[516,1091,1092,1117,1130,1141,1154,1169],{},[503,1093,1094,1099],{},[521,1095,1096],{},[458,1097,1098],{},"Keine neuen Server mehr anmelden",[521,1100,1101,1102,1105,1106,1105,1113,1116],{},"Enrollment-Token unter ",[458,1103,1104],{},"Einstellungen"," → ",[461,1107,1110],{"href":1108,"rel":1109,"target":466},"https:\u002F\u002Fapp.livck.cloud\u002Fsettings\u002Forganization\u002Fenrollment-tokens",[465],[458,1111,1112],{},"Organisation",[458,1114,1115],{},"Enrollment-Tokens"," widerrufen oder rotieren",[503,1118,1119,1124],{},[521,1120,1121],{},[458,1122,1123],{},"Diesen Server sofort stumm schalten",[521,1125,1126,1129],{},[489,1127,1128],{},"sudo systemctl stop livck-agent"," -- die Datenübertragung endet augenblicklich",[503,1131,1132,1137],{},[521,1133,1134],{},[458,1135,1136],{},"Automatische Updates unterbinden",[521,1138,1139],{},[489,1140,623],{},[503,1142,1143,1148],{},[521,1144,1145],{},[458,1146,1147],{},"Agent vollständig entfernen",[521,1149,1150,1153],{},[489,1151,1152],{},"sudo livck-agent uninstall"," -- entfernt Dienst, Dateien, Zugangsdaten und Systembenutzer",[503,1155,1156,1161],{},[521,1157,1158],{},[458,1159,1160],{},"Ausgehend blockieren",[521,1162,1163,1164,712,1166,1168],{},"Verbindungen zu ",[489,1165,538],{},[489,1167,525],{}," in deiner Firewall sperren",[503,1170,1171,1176],{},[521,1172,1173],{},[458,1174,1175],{},"Daten in LIVCK löschen",[521,1177,1178],{},"Server in der Serverliste löschen -- Metriken, Ereignisse und Historie werden mitgelöscht",[448,1180,1182],{"id":1181},"wenn-dein-sicherheitsteam-fragen-hat","Wenn dein Sicherheitsteam Fragen hat",[444,1184,1185],{},"Nützliche Einstiegspunkte im Repository:",[591,1187,1188,1197,1206,1216,1226],{},[594,1189,1190,1196],{},[461,1191,1193],{"href":463,"rel":1192,"target":466},[465],[489,1194,1195],{},"README.md"," -- Aufbau und Grundsätze",[594,1198,1199,1205],{},[461,1200,1202],{"href":776,"rel":1201,"target":466},[465],[489,1203,1204],{},"packaging\u002Fsystemd\u002Flivck-agent.service"," -- die Absicherung des Dienstes, jede Zeile kommentiert",[594,1207,1208,1215],{},[461,1209,1212],{"href":1210,"rel":1211,"target":466},"https:\u002F\u002Fgithub.com\u002FLIVCK\u002Fagent\u002Fblob\u002Fmain\u002Fpackaging\u002Finstall.sh",[465],[489,1213,1214],{},"packaging\u002Finstall.sh"," -- was der Installer genau tut",[594,1217,1218,1225],{},[461,1219,1222],{"href":1220,"rel":1221,"target":466},"https:\u002F\u002Fgithub.com\u002FLIVCK\u002Fagent\u002Ftree\u002Fmain\u002Finternal\u002Fcollector",[465],[489,1223,1224],{},"internal\u002Fcollector\u002F"," -- jeder einzelne Messwert und woher er stammt",[594,1227,1228,1235],{},[461,1229,1232],{"href":1230,"rel":1231,"target":466},"https:\u002F\u002Fgithub.com\u002FLIVCK\u002Fagent\u002Fblob\u002Fmain\u002Fpkg\u002Fwire\u002FCONTRACT.md",[465],[489,1233,1234],{},"pkg\u002Fwire\u002FCONTRACT.md"," -- das vollständige Protokoll zwischen Agent und LIVCK",[444,1237,1238],{},"Findest du eine Sicherheitslücke, melde sie bitte über den Support statt über ein öffentliches Issue.",[448,1240,1242],{"id":1241},"weiterführende-themen","Weiterführende Themen",[591,1244,1245,1250,1255,1260],{},[594,1246,1247,1249],{},[461,1248,122],{"href":123}," -- jeder Messwert in Klartext",[594,1251,1252,1254],{},[461,1253,114],{"href":115}," -- Installation und Deinstallation",[594,1256,1257,1259],{},[461,1258,142],{"href":143}," -- wie neue Versionen auf den Server kommen",[594,1261,1262,1264],{},[461,1263,420],{"href":421}," -- Datenschutz und Hosting",{"title":1266,"searchDepth":1267,"depth":1267,"links":1268},"",3,[1269,1271,1277,1278,1279,1280,1281,1282],{"id":450,"depth":1270,"text":451},2,{"id":474,"depth":1270,"text":475,"children":1272},[1273,1274,1275,1276],{"id":479,"depth":1267,"text":480},{"id":571,"depth":1267,"text":572},{"id":626,"depth":1267,"text":627},{"id":781,"depth":1267,"text":782},{"id":953,"depth":1270,"text":954},{"id":983,"depth":1270,"text":984},{"id":1041,"depth":1270,"text":1042},{"id":1074,"depth":1270,"text":1075},{"id":1181,"depth":1270,"text":1182},{"id":1241,"depth":1270,"text":1242},"Warum du dem LIVCK-Agenten vertrauen kannst -- quelloffen, nur ausgehend, ohne Fernsteuerung und ohne Root-Rechte.","md",{},null,{"title":118,"description":1283},"2picPFRXuhbnkJdmBWq4DukaOU2guSfTg4hcxHBnRxg",1784953292729]