Comments (14)
Built-in basic auth would be appreciated from my end as well. Of course I can reverse-proxy the node-exporter, but thatβs one more config file and dependency in my setup :|.
from node_exporter.
As a reverse proxy is now needed for any security/authentication measurement, shouldn't the node exporter only listen on localhost by default?
from node_exporter.
@juliusv Sorry, my goal was to express strong disagreement, not to be impolite.
For perspective and reference, here's a list of competing/related tools that have TLS:
- CollectD
- Icinga
- InfluxDB
- Munin
- Nagios
- OpenTSDB
- Riemann
- Sensu
- StatsD
- Zenoss (couldn't find proper docs here, but their agents talk SSL, too)
I was going to add a list of monitoring tools that don't implement TLS as well, but couldn't find any. Not a single one.
from node_exporter.
Yes, I agree with you. But I think system must have his own basic simple auth for simple installation with security support. It is very important, beleave me:) This option can be disable by default.
from node_exporter.
I agree with @svagner. I understand the desire to not go down the slippery slope of supporting a plethora of auth types, but having basic auth in there is very valuable for people who want simple protection and don't want the added cost of installing, configuring, and running a reverse proxy.
from node_exporter.
Agreeing in general. I also think this should be added (well, no suprise given that I added basic auth back then).
from node_exporter.
Why? May be you should add oppotunity for anable or disable this auth? The point is that many systems doesn't have any reverse proxyes and install this proxies at all nodes isn't correct politic for organization (in highload systems it can give many problems). If we install some reverse proxy we have more one point of deniel. It isn't good.
from node_exporter.
Let's say we did support basic auth (which doesn't seem like the plan), then we'd also need to support TLS to make the basic auth useful. So now we have a much more complex problem already (there are many ways of configuring TLS). There's an FAQ item on this now btw.: https://prometheus.io/docs/introduction/faq/#why-don't-the-prometheus-server-components-support-tls-or-authentication?-can-i-add-those?
from node_exporter.
This should really be implemented in prometheus where it
can be peer-reviewed and is then available to all users.
Shifting the burden onto your users is not only a royal pain in the ass
but also results in brittle and insecure deployments all over the place.
node_exporter is supposed to run on many hosts, which in most environments
translates to many different OS's and patch levels.
Prometheus should not ask admins to build and maintain multi-platform
training wheels for something as basic as their monitoring probe.
from node_exporter.
Yes, transport security and auth very much on my mind. I've already added this to the agenda for the next developer's summit which happens in a couple weeks as part of PromCon.
This issue is not the place to discuss changes, as it's an ecosystem wide policy change.
Feel free to start a conversation on the Prometheus community developers list. We need to consider the whole scope of securing monitoring endpoints.
Please keep the discussion professional. Rants and aggressive language will not be tolerated.
from node_exporter.
Basic auth is just one of many potential ways that a user could do auth, there's LDAP, Kerberos, OTP plus all the directory systems and policies that may be associated with them.
Rather than spending an ever increasing amount of time creating and maintaining such integrations, we've chosen to delegate the responsibility to other projects that handle this problem already.
from node_exporter.
I understand this slippery slope as well +1 to adding in only basic support and an option to disable (if both are blank) or a flag.
from node_exporter.
@m-o-e "should" is a subjective judgement. There's pros and cons to each side, but the fact is that anything that is in Prometheus proper needs to be maintained by Prometheus people, and that needs capacity and ongoing commitment.
I am personally ambivalent about this issue, as I feel both sides have good arguments. I would personally like to have a Prometheus supporting all that, I'm less sure about wanting to maintain it :) People like @SuperQ (also Prometheus team) are very much in favor of adding TLS+auth to Prometheus components themselves, but that isn't consensus yet. @brian-brazil has been historically the most cautious person against it, but also indicated that he might be willing to reconsider that if someone puts together a security and response plan for all this, along with recommendations from security people on what to watch out for. I think there was a mailing list thread about this once started by @SuperQ, maybe he can dig it out.
from node_exporter.
I'd suggest to raise this general topic on the prometheus mailing list and discuss it there. Not sure what the latest state of this discussion is.
@Jasper-Ben Yeah, that could make sense indeed.. @SuperQ wdyt?
from node_exporter.
Related Issues (20)
- Grafana angular deprecation in grafana 11
- Pressure metric collection fails on systems that do not expose a full CPU stat HOT 1
- Error when reading same metrics from multiple files, one with and one without a HELP entry
- Node_exporter isn't reading transmit data on enp1s0 HOT 1
- openwrt : ramips/mt7621 run node_exporter failed HOT 3
- Missing file system metrics for /dev/shm HOT 4
- Exporter may freeze if network file system is unavailable HOT 4
- fatal error: concurrent map writes in github.com/prometheus/node_exporter v1.7.0 HOT 2
- New patch release HOT 2
- runit collector reports invalid (outdated) service state if runsv (supervisor process) is not running HOT 3
- thermal_zone collector stuck on Jetson Orin Nano HOT 1
- Bug: collector.arp.netlink is super slow to retrieve metrics HOT 2
- caller=stdlib.go caller='error encoding and sending metric family:write tcp 10.10.10.10:9100' msg=">192.168.3.12:47158:write:broken pipe" HOT 2
- Question about the procfs package
- NewNodeCollector all collectors disabled
- Node exporter have high memory usage in some nodes HOT 4
- node_exporter cannot parse drbd 8.4.11 stat file HOT 4
- several collectors fail on OpenBSD 7.5 HOT 1
- AWS ECS implementation
- Have you considered adding support for ebpf? HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
π Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. πππ
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google β€οΈ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from node_exporter.