OPNsense - installing other software on the same hardware - security risk?

[chilipepper]

Hello everyone.

I'm a total newcomer to the whole custom firewall thing, so i have a few questions. I hope its okay to ask them here...


I installed OPNsense on a bare metal server - no virtualization.

I'd like to tinker a little bit with it and collect extensive performance data.

I thought about installing influxdb to collect the data.

Is it safe to install influx via the freebsd package into my firewall server? Or is it stupid to install any additional software on that specific system?


Best regards!

[cookiemonster]

To an extent, it depends.
In a corporate envrionment, it's discouraged and even forbidden. It can be a security vector. In a home envrionment, you make your own assessments.
You need to find the balance between following accepted wisdom of keep it with as little addition as possible to avoid problems unrelated to the distribution, and the best use of your hardware.
I'd say as long as is part of the core firewall, there are bits that are fine to do. Data collection for your example is in my opinion, well within that scope. For instance installing containers, jails, media apps like plex, etc. no.
The argument of well I have all these compute resources underutilised and saves me from having another device consuming power, etc. doesn't fly with me but hey, each to their own.
For influxdb, there's a community plugin I think.