Catalog / Observability & monitoring

Checkmk Community Edition

Infrastructure and application monitoring with agent-based checks and alerting

CIS Level 1 hardened Ubuntu 24.04 LTS image by Lynxroute · unique credentials at first boot · CVE-scanned · SBOM and CIS report inside

AWS Marketplace2.5.0p17↗ Azure Marketplace2.5.0p17↗
Availability and pricing
CloudVersionSoftware priceLast build
AWS Marketplace
EC2 AMI · all commercial regions
2.5.0p17$0.05/hr
Recommended instance: t3.large · 5-day free trial
2026-10-23Listing ↗
Azure Marketplace
VM image · plan payg-gen2 · Gen2
2.5.0p17$0.028/vCPU/hr
Recommended VM: Standard_D2s_v3
2026-10-24Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts
Base OSUbuntu 24.04 LTS
HardeningCIS Level 1, Ubuntu 24.04 LTS (tailored)
LicenseGPL-2.0
UpstreamCheckmk GmbH
Machine-readableproduct.json · catalog.json
What is Checkmk Community Edition

Checkmk Community Edition is the free, GPL-2.0 edition of Checkmk, a monitoring system for servers, applications, networks, cloud services and containers. It is distributed as a self-contained stack: a single package brings its own Apache, Python runtime, Redis cache, RabbitMQ message broker, RRD time-series storage and monitoring core, so nothing has to be assembled from separate services. Monitoring is agent-based or agentless, and the service discovery is the point of the product: install the agent on a host, run a discovery, and Checkmk proposes the services it found rather than making you declare them. Several hundred official check plug-ins cover Linux, Windows, VMware, Kubernetes, databases, network hardware via SNMP, and the major cloud APIs. Configuration is done in the web UI with an explicit Activate-changes step, and a REST API covers the same operations for automation. GPL-2.0 license, no vendor lock-in.

What the Lynxroute image adds

Security hardening:

  • The monitoring site is created on YOUR instance at first boot, not baked into the image - so its certificate authority, session-signing secret, automation secret and admin password are unique to your instance and exist nowhere else
  • Admin password generated at first boot and written to a root-only credentials file
  • Every site listener pinned to loopback - the site web server, the system web server and the message broker are reachable only from the instance itself, with nginx terminating TLS on 443 in front of them
  • The message broker's shipped default listens on all interfaces; this build overrides it to 127.0.0.1
  • Self-signed certificate out of the box and Certbot pre-installed, so a CA-signed certificate is one command away
  • Unused listening services that arrive as package dependencies are masked
  • UFW firewall pre-configured - SSH 22 and HTTPS 443; port 80 only redirects to HTTPS and carries the certificate-issuance challenge
  • fail2ban, AppArmor
  • CVE scan - every image is scanned for vulnerabilities before release

Ready to use on first login:

  • The Checkmk agent is installed on this server, so adding it as your first host takes three clicks and service discovery finds its services immediately

OS hardening (CIS Level 1):

  • CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
  • auditd, SSH hardening, Kernel hardening, IMDSv2 enforced

Compliance artifacts:

  • SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
  • CIS Conformance Report at /etc/lynxroute/cis-report.html
  • CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
Deploy

Launch in one command

Credentials are generated at first boot and written to /root/checkmk-credentials.txt.

# subscribe once on the AWS Marketplace listing, then:
aws ec2 run-instances \
  --image-id resolve:ssm:/aws/service/marketplace/prod-g36bwb2uzsfmm/latest \
  --instance-type t3.large --key-name my-key --security-group-ids sg-xxxxxxxx
# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer checkmk --plan payg-gen2
az vm create -g my-rg -n checkmk --size Standard_D2s_v3 \
  --image lynxroute:checkmk:payg-gen2:latest --admin-username azureuser --generate-ssh-keys
Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

Checkmk 2.5.0p17

AWS · 2026-10-23Azure · 2026-10-24
  • Checkmk Community updated 2.5.0p14 -> 2.5.0p17. GPL-2.0 unchanged
  • Security: CVE-2026-14452 (open redirect / XSS), CVE-2026-84112 (mk-job injection), CVE-2026-92882 (SNMP/IPMI secret redaction), CVE-2026-90956, CVE-2026-110511 and CVE-2024-28828 (CSRF), CVE-2026-103682 and CVE-2026-103674 (credentials visible in the process list), CVE-2026-105331
  • Security: ships the PHP2Shell fix (CVE-2026-109618, CVE-2026-109619; unauthenticated remote code execution in PHP) via Ubuntu php8.3 8.3.6-0ubuntu0.24.04.13 (USN-8948-1). Earlier images of this product carry the vulnerable PHP and should be replaced
  • Bundled Redis remains under AGPL-3.0 with the source offer described in the product notes
  • Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build