Merge security documents (#14588)
* Bring in info from docs/configure/secure-nodes.md Will remove secure-nodes.md * Delete secure-nodes.md * Change link to node security * Update common-changes.md * Update nodes.md * Fix link in infrastructure doc
Chris Akritidis committed
Feb 22, 2023 at 10:17 UTC
0cb21b342f73bedd1ca04240e2d8932f188e8017
5 files changed
+89
-305
docs/configure/common-changes.md
+1
-93
@@ -29,16 +29,6 @@ changes reflected in those visualizations due to the way Netdata Cloud proxies m
29
30
### Increase the long-term metrics retention period
31
32
-Increase the values for the `page cache size` and `dbengine multihost disk space` settings in
33
-the [`[global]`section](https://github.com/netdata/netdata/blob/master/daemon/config/README.md#global-section-options)
34
-of `netdata.conf`.
35
-
36
-```conf
37
-[global]
38
- page cache size = 128 # 128 MiB of memory for metrics storage
39
- dbengine multihost disk space = 4096 # 4GiB of disk space for metrics storage
40
-```
41
-
32
Read our doc
33
on [increasing long-term metrics storage](https://github.com/netdata/netdata/blob/master/docs/store/change-metrics-storage.md)
34
for details, including a
@@ -142,56 +132,7 @@ click on the link to your preferred notification method to find documentation fo
132
While the Netdata Agent is both [open and secure by design](https://www.netdata.cloud/blog/netdata-agent-dashboard/), we
133
recommend every user take some action to administer and secure their nodes.
134
145
-Learn more about a few of the following changes in
146
-the [node security doc](https://github.com/netdata/netdata/blob/master/docs/configure/secure-nodes.md).
147
-
148
-### Disable the local Agent dashboard (`http://NODE:19999`)
149
-
150
-If you use Netdata Cloud to visualize metrics, stream metrics to a parent node, or otherwise don't need the local Agent
151
-dashboard, disabling it reduces the Agent's resource utilization and improves security.
152
-
153
-Change the `mode` setting to `none` in
154
-the [`[web]` section](https://github.com/netdata/netdata/blob/master/web/server/README.md#configuration)
155
-of `netdata.conf`.
156
-
157
-```conf
158
-[web]
159
- mode = none
160
-```
161
-
162
-### Use access lists to restrict access to specific assets
163
-
164
-Allow access from only specific IP addresses, ranges of IP addresses, or hostnames
165
-using [access lists](https://github.com/netdata/netdata/blob/master/web/server/README.md#access-lists)
166
-and [simple patterns](https://github.com/netdata/netdata/blob/master/libnetdata/simple_pattern/README.md).
167
-
168
-See a quickstart to access lists in the [node security
169
-doc](https://github.com/netdata/netdata/blob/master/docs/configure/secure-nodes.md#restrict-access-to-the-local-dashboard).
170
-
171
-### Stop sending anonymous statistics to Google Analytics
172
-
173
-Create a file called `.opt-out-from-anonymous-statistics` inside of your Netdata config directory to immediately stop
174
-the statistics script.
175
-
176
-```bash
177
-sudo touch .opt-out-from-anonymous-statistics
178
-```
179
-
180
-Learn more
181
-about [why we collect anonymous statistics](https://github.com/netdata/netdata/blob/master/docs/anonymous-statistics.md).
182
-
183
-### Change the IP address/port Netdata listens to
184
-
185
-Change the `default port` setting in the `[web]` section to a port other than `19999`.
186
-
187
-```conf
188
-[web]
189
- default port = 39999
190
-```
191
-
192
-Use the `bind to` setting to the ports other assets, such as
193
-the [running `netdata.conf` configuration](https://github.com/netdata/netdata/blob/master/docs/configure/nodes.md#see-an-agents-running-configuration),
194
-API, or streaming requests listen to.
135
+Learn more about the available options in the [security design documentation](https://github.com/netdata/netdata/blob/master/docs/netdata-security.md).
136
137
## Reduce resource usage
138
@@ -217,36 +158,3 @@ The following restrictions apply to host label names:
158
The policy for values is more flexible, but you can not use exclamation marks (`!`), whitespaces (` `), single quotes
159
(`'`), double quotes (`"`), or asterisks (`*`), because they are used to compare label values in health alarms and
160
templates.
220
-
221
-## What's next?
222
-
223
-If you haven't already, learn how
224
-to [secure your nodes](https://github.com/netdata/netdata/blob/master/docs/configure/secure-nodes.md).
225
-
226
-As mentioned at the top, there are plenty of other
227
-
228
-You can also take what you've learned about node configuration to tweak the Agent's behavior or enable new features:
229
-
230
-- [Enable new collectors](https://github.com/netdata/netdata/blob/master/collectors/REFERENCE.md#enable-and-disable-a-specific-collection-module) or tweak
231
- their behavior.
232
-- [Configure existing health alarms](https://github.com/netdata/netdata/blob/master/health/REFERENCE.md) or
233
- create new ones.
234
-- [Enable notifications](https://github.com/netdata/netdata/blob/master/docs/monitor/enable-notifications.md) to receive
235
- updates about the health of your
236
- infrastructure.
237
--
238
-
239
-Change [the long-term metrics retention period](https://github.com/netdata/netdata/blob/master/docs/store/change-metrics-storage.md)
240
-using the database engine.
241
-
242
-### Related reference documentation
243
-
244
-- [Netdata Agent · Daemon](https://github.com/netdata/netdata/blob/master/health/README.md)
245
-- [Netdata Agent · Daemon configuration](https://github.com/netdata/netdata/blob/master/daemon/config/README.md)
246
-- [Netdata Agent · Web server](https://github.com/netdata/netdata/blob/master/web/server/README.md)
247
-- [Netdata Agent · Local Agent dashboard](https://github.com/netdata/netdata/blob/master/web/gui/README.md)
248
-- [Netdata Agent · Health monitoring](https://github.com/netdata/netdata/blob/master/health/REFERENCE.md)
249
-- [Netdata Agent · Notifications](https://github.com/netdata/netdata/blob/master/health/notifications/README.md)
250
-- [Netdata Agent · Simple patterns](https://github.com/netdata/netdata/blob/master/libnetdata/simple_pattern/README.md)
251
-
252
-[](<>)
docs/configure/nodes.md
-26
@@ -147,29 +147,3 @@ wget -O /etc/netdata/netdata.conf http://localhost:19999/netdata.conf
147
# or
148
curl -o /etc/netdata/netdata.conf http://NODE:19999/netdata.conf
149
```
150
-
151
-## What's next?
152
-
153
-Learn more about [starting, stopping, or restarting](https://github.com/netdata/netdata/blob/master/docs/configure/start-stop-restart.md) the Netdata daemon to apply
154
-configuration changes.
155
-
156
-Apply some [common configuration changes](https://github.com/netdata/netdata/blob/master/docs/configure/common-changes.md) to quickly tweak the Agent's behavior.
157
-
158
-[Add security to your node](https://github.com/netdata/netdata/blob/master/docs/configure/secure-nodes.md) with what you've learned about the Netdata config directory
159
-and `edit-config`. We put together a few security best practices based on how you use the Netdata.
160
-
161
-You can also take what you've learned about node configuration to enable or enhance features:
162
-
163
-- [Enable new collectors](https://github.com/netdata/netdata/blob/master/collectors/REFERENCE.md) or tweak their behavior.
164
-- [Configure existing health alarms](https://github.com/netdata/netdata/blob/master/health/REFERENCE.md) or create new ones.
165
-- [Enable notifications](https://github.com/netdata/netdata/blob/master/docs/monitor/enable-notifications.md) to receive updates about the health of your
166
- infrastructure.
167
-- Change [the long-term metrics retention period](https://github.com/netdata/netdata/blob/master/docs/store/change-metrics-storage.md) using the database engine.
168
-
169
-### Related reference documentation
170
-
171
-- [Netdata Agent · Daemon](https://github.com/netdata/netdata/blob/master/daemon/README.md)
172
-- [Netdata Agent · Health monitoring](https://github.com/netdata/netdata/blob/master/health/README.md)
173
-- [Netdata Agent · Notifications](https://github.com/netdata/netdata/blob/master/health/notifications/README.md)
174
-
175
-[](<>)
docs/configure/secure-nodes.md
deleted
-127
@@ -1,127 +0,0 @@
1
-<!--
2
-title: "Secure your nodes"
3
-description: "Your data and systems are safe with Netdata, but we recommend a few easy ways to improve the security of your infrastructure."
4
-custom_edit_url: "https://github.com/netdata/netdata/edit/master/docs/configure/secure-nodes.md"
5
-sidebar_label: "Secure your nodes"
6
-learn_status: "Published"
7
-learn_topic_type: "Tasks"
8
-learn_rel_path: "Configuration/Secure your nodes"
9
--->
10
-
11
-# Secure your nodes
12
-
13
-Upon installation, the Netdata Agent serves the **local dashboard** at port `19999`. If the node is accessible to the
14
-internet at large, anyone can access the dashboard and your node's metrics at `http://NODE:19999`. We made this decision
15
-so that the local dashboard was immediately accessible to users, and so that we don't dictate how professionals set up
16
-and secure their infrastructures.
17
-
18
-Despite this design decision, your [data](https://github.com/netdata/netdata/blob/master/docs/netdata-security.md#your-data-is-safe-with-netdata) and your
19
-[systems](https://github.com/netdata/netdata/blob/master/docs/netdata-security.md#your-systems-are-safe-with-netdata) are safe with Netdata. Netdata is read-only,
20
-cannot do anything other than present metrics, and runs without special/`sudo` privileges. Also, the local dashboard
21
-only exposes chart metadata and metric values, not raw data.
22
-
23
-While Netdata is secure by design, we believe you should [protect your
24
-nodes](https://github.com/netdata/netdata/blob/master/docs/netdata-security.md#why-netdata-should-be-protected). If left accessible to the internet at large, the
25
-local dashboard could reveal sensitive information about your infrastructure. For example, an attacker can view which
26
-applications you run (databases, webservers, and so on), or see every user account on a node.
27
-
28
-Instead of dictating how to secure your infrastructure, we give you many options to establish security best practices
29
-that align with your goals and your organization's standards.
30
-
31
-- [Disable the local dashboard](#disable-the-local-dashboard): **Simplest and recommended method** for those who have
32
- added nodes to Netdata Cloud and view dashboards and metrics there.
33
-- [Restrict access to the local dashboard](#restrict-access-to-the-local-dashboard): Allow local dashboard access from
34
- only certain IP addresses, such as a trusted static IP or connections from behind a management LAN. Full support for
35
- Netdata Cloud.
36
-- [Use a reverse proxy](#use-a-reverse-proxy): Password-protect a local dashboard and enable TLS to secure it. Full
37
- support for Netdata Cloud.
38
-
39
-## Disable the local dashboard
40
-
41
-This is the _recommended method for those who have connected their nodes to Netdata Cloud_ and prefer viewing real-time
42
-metrics using the War Room Overview, Nodes view, and Cloud dashboards.
43
-
44
-You can disable the local dashboard (and API) but retain the encrypted Agent-Cloud link ([ACLK](https://github.com/netdata/netdata/blob/master/aclk/README.md)) that
45
-allows you to stream metrics on demand from your nodes via the Netdata Cloud interface. This change mitigates all
46
-concerns about revealing metrics and system design to the internet at large, while keeping all the functionality you
47
-need to view metrics and troubleshoot issues with Netdata Cloud.
48
-
49
-Open `netdata.conf` with `./edit-config netdata.conf`. Scroll down to the `[web]` section, and find the `mode =
50
-static-threaded` setting, and change it to `none`.
51
-
52
-```conf
53
-[web]
54
- mode = none
55
-```
56
-
57
-Save and close the editor, then [restart your Agent](https://github.com/netdata/netdata/blob/master/docs/configure/start-stop-restart.md) using `sudo systemctl
58
-restart netdata`. If you try to visit the local dashboard to `http://NODE:19999` again, the connection will fail because
59
-that node no longer serves its local dashboard.
60
-
61
-> See the [configuration basics doc](https://github.com/netdata/netdata/blob/master/docs/configure/nodes.md) for details on how to find `netdata.conf` and use
62
-> `edit-config`.
63
-
64
-## Restrict access to the local dashboard
65
-
66
-If you want to keep using the local dashboard, but don't want it exposed to the internet, you can restrict access with
67
-[access lists](https://github.com/netdata/netdata/blob/master/web/server/README.md#access-lists). This method also fully retains the ability to stream metrics
68
-on-demand through Netdata Cloud.
69
-
70
-The `allow connections from` setting helps you allow only certain IP addresses or FQDN/hostnames, such as a trusted
71
-static IP, only `localhost`, or connections from behind a management LAN.
72
-
73
-By default, this setting is `localhost *`. This setting allows connections from `localhost` in addition to _all_
74
-connections, using the `*` wildcard. You can change this setting using Netdata's [simple
75
-patterns](https://github.com/netdata/netdata/blob/master/libnetdata/simple_pattern/README.md).
76
-
77
-```conf
78
-[web]
79
- # Allow only localhost connections
80
- allow connections from = localhost
81
-
82
- # Allow only from management LAN running on `10.X.X.X`
83
- allow connections from = 10.*
84
-
85
- # Allow connections only from a specific FQDN/hostname
86
- allow connections from = example*
87
-```
88
-
89
-The `allow connections from` setting is global and restricts access to the dashboard, badges, streaming, API, and
90
-`netdata.conf`, but you can also set each of those access lists more granularly if you choose:
91
-
92
-```conf
93
-[web]
94
- allow connections from = localhost *
95
- allow dashboard from = localhost *
96
- allow badges from = *
97
- allow streaming from = *
98
- allow netdata.conf from = localhost fd* 10.* 192.168.* 172.16.* 172.17.* 172.18.* 172.19.* 172.20.* 172.21.* 172.22.* 172.23.* 172.24.* 172.25.* 172.26.* 172.27.* 172.28.* 172.29.* 172.30.* 172.31.*
99
- allow management from = localhost
100
-```
101
-
102
-See the [web server](https://github.com/netdata/netdata/blob/master/web/server/README.md#access-lists) docs for additional details about access lists. You can take
103
-access lists one step further by [enabling SSL](https://github.com/netdata/netdata/blob/master/web/server/README.md#enabling-tls-support) to encrypt data from local
104
-dashboard in transit. The connection to Netdata Cloud is always secured with TLS.
105
-
106
-## Use a reverse proxy
107
-
108
-You can also put Netdata behind a reverse proxy for additional security while retaining the functionality of both the
109
-local dashboard and Netdata Cloud dashboards. You can use a reverse proxy to password-protect the local dashboard and
110
-enable HTTPS to encrypt metadata and metric values in transit.
111
-
112
-We recommend Nginx, as it's what we use for our [demo server](https://london.my-netdata.io/), and we have a guide
113
-dedicated to [running Netdata behind Nginx](https://github.com/netdata/netdata/blob/master/docs/Running-behind-nginx.md).
114
-
115
-We also have guides for [Apache](https://github.com/netdata/netdata/blob/master/docs/Running-behind-apache.md), [Lighttpd](https://github.com/netdata/netdata/blob/master/docs/Running-behind-lighttpd.md),
116
-[HAProxy](https://github.com/netdata/netdata/blob/master/docs/Running-behind-haproxy.md), and [Caddy](https://github.com/netdata/netdata/blob/master/docs/Running-behind-caddy.md).
117
-
118
-## What's next?
119
-
120
-Read about [Netdata's security design](https://github.com/netdata/netdata/blob/master/docs/netdata-security.md) and our [blog
121
-post](https://www.netdata.cloud/blog/netdata-agent-dashboard/) about why the local Agent dashboard is both open and
122
-secure by design.
123
-
124
-Next up, learn about [collectors](https://github.com/netdata/netdata/blob/master/collectors/README.md) to ensure you're gathering every essential
125
-metric about your node, its applications, and your infrastructure at large.
126
-
127
-[](<>)
docs/netdata-security.md
+87
-58
@@ -14,21 +14,13 @@ We have given special attention to all aspects of Netdata, ensuring that everyth
14
15
**Table of Contents**
16
17
-- [Security design](#security-design)
18
- - [Your data is safe with Netdata](#your-data-is-safe-with-netdata)
19
- - [Your systems are safe with Netdata](#your-systems-are-safe-with-netdata)
20
- - [Netdata is read-only](#netdata-is-read-only)
21
- - [Netdata viewers authentication](#netdata-viewers-authentication)
22
- - [Why Netdata should be protected](#why-netdata-should-be-protected)
23
- - [Protect Netdata from the internet](#protect-netdata-from-the-internet)
24
- - [Expose Netdata only in a private LAN](#expose-netdata-only-in-a-private-lan)
25
- - [Fine-grained access control](#fine-grained-access-control)
26
- - [Use an authenticating web server in proxy mode](#use-an-authenticating-web-server-in-proxy-mode)
27
- - [Other methods](#other-methods)
28
- - [Anonymous Statistics](#anonymous-statistics)
29
- - [Registry or how to not send any information to a third party server](#registry-or-how-to-not-send-any-information-to-a-third-party-server)
30
- - [Opt-out of anonymous statistics](#opt-out-of-anonymous-statistics)
31
- - [Netdata directories](#netdata-directories)
17
+- [Your data is safe with Netdata](#your-data-is-safe-with-netdata)
18
+- [Your systems are safe with Netdata](#your-systems-are-safe-with-netdata)
19
+- [Netdata is read-only](#netdata-is-read-only)
20
+- [Why Netdata should be protected](#why-netdata-should-be-protected)
21
+- [Protect Netdata from the internet](#protect-netdata-from-the-internet)
22
+- [Anonymous Statistics](#anonymous-statistics)
23
+- [Netdata directories](#netdata-directories)
24
25
## Your data is safe with Netdata
26
@@ -59,11 +51,14 @@ Netdata **dashboards are read-only**. Dashboard users can view and examine metri
51
52
Netdata dashboards do not expose sensitive information. Business data of any kind, the kernel version, O/S version, application versions, host IPs, etc are not stored and are not exposed by Netdata on its dashboards.
53
62
-## Netdata viewers authentication
54
+## Why Netdata should be protected
55
56
Netdata is a monitoring system. It should be protected, the same way you protect all your admin apps. We assume Netdata will be installed privately, for your eyes only.
57
66
-### Why Netdata should be protected
58
+Upon installation, the Netdata Agent serves the **local dashboard** at port `19999`. If the node is accessible to the
59
+internet at large, anyone can access the dashboard and your node's metrics at `http://NODE:19999`. We made this decision
60
+so that the local dashboard was immediately accessible to users, and so that we don't dictate how professionals set up
61
+and secure their infrastructures.
62
63
Viewers will be able to get some information about the system Netdata is running. This information is everything the dashboard provides. The dashboard includes a list of the services each system runs (the legends of the charts under the `Systemd Services` section), the applications running (the legends of the charts under the `Applications` section), the disks of the system and their names, the user accounts of the system that are running processes (the `Users` and `User Groups` section of the dashboard), the network interfaces and their names (not the IPs) and detailed information about the performance of the system and its applications.
64
@@ -71,13 +66,50 @@ This information is not sensitive (meaning that it is not your business data), b
66
67
Also, viewers could use Netdata itself to stress your servers. Although the Netdata daemon runs unprivileged, with the minimum process priority (scheduling priority `idle` - lower than nice 19) and adjusts its OutOfMemory (OOM) score to 1000 (so that it will be first to be killed by the kernel if the system starves for memory), some pressure can be applied on your systems if someone attempts a DDoS against Netdata.
68
74
-### Protect Netdata from the internet
69
+## Protect Netdata from the internet
70
76
-Netdata is a distributed application. Most likely you will have many installations of it. Since it is distributed and you are expected to jump from server to server, there is very little usability to add authentication local on each Netdata.
71
+Instead of dictating how to secure your infrastructure, we give you many options to establish security best practices
72
+that align with your goals and your organization's standards.
73
78
-Until we add a distributed authentication method to Netdata, you have the following options:
74
+- [Disable the local dashboard](#disable-the-local-dashboard): **Simplest and recommended method** for those who have
75
+ added nodes to Netdata Cloud and view dashboards and metrics there.
76
80
-#### Expose Netdata only in a private LAN
77
+- [Expose Netdata only in a private LAN](#expose-netdata-only-in-a-private-lan). Simplest and recommended method for those who do not use Netdata Cloud.
78
+
79
+- [Fine-grained access control](#fine-grained-access-control): Allow local dashboard access from
80
+ only certain IP addresses, such as a trusted static IP or connections from behind a management LAN. Full support for Netdata Cloud.
81
+
82
+- [Use a reverse proxy (authenticating web server in proxy mode)](#use-an-authenticating-web-server-in-proxy-mode): Password-protect
83
+ a local dashboard and enable TLS to secure it. Full support for Netdata Cloud.
84
+
85
+- [Other methods](#other-methods) list some less common methods of protecting Netdata.
86
+
87
+### Disable the local dashboard
88
+
89
+This is the _recommended method for those who have connected their nodes to Netdata Cloud_ and prefer viewing real-time
90
+metrics using the War Room Overview, Nodes view, and Cloud dashboards.
91
+
92
+You can disable the local dashboard (and API) but retain the encrypted Agent-Cloud link ([ACLK](https://github.com/netdata/netdata/blob/master/aclk/README.md)) that
93
+allows you to stream metrics on demand from your nodes via the Netdata Cloud interface. This change mitigates all
94
+concerns about revealing metrics and system design to the internet at large, while keeping all the functionality you
95
+need to view metrics and troubleshoot issues with Netdata Cloud.
96
+
97
+Open `netdata.conf` with `./edit-config netdata.conf`. Scroll down to the `[web]` section, and find the `mode =
98
+static-threaded` setting, and change it to `none`.
99
+
100
+```conf
101
+[web]
102
+ mode = none
103
+```
104
+
105
+Save and close the editor, then [restart your Agent](https://github.com/netdata/netdata/blob/master/docs/configure/start-stop-restart.md) using `sudo systemctl
106
+restart netdata`. If you try to visit the local dashboard to `http://NODE:19999` again, the connection will fail because
107
+that node no longer serves its local dashboard.
108
+
109
+> See the [configuration basics doc](https://github.com/netdata/netdata/blob/master/docs/configure/nodes.md) for details on how to find `netdata.conf` and use
110
+> `edit-config`.
111
+
112
+### Expose Netdata only in a private LAN
113
114
If your organisation has a private administration and management LAN, you can bind Netdata on this network interface on all your servers. This is done in `Netdata.conf` with these settings:
115
@@ -94,52 +126,49 @@ For cloud based installations, if your cloud provider does not provide such a pr
126
127
For `gvpe` we have developed a [simple provisioning tool](https://github.com/netdata/netdata-demo-site/tree/master/gvpe) you may find handy (it includes statically compiled `gvpe` binaries for Linux and FreeBSD, and also a script to compile `gvpe` on your macOS system). We use this to create a management and administration LAN for all Netdata demo sites (spread all over the internet using multiple hosting providers).
128
97
----
98
-
99
-In Netdata v1.9+ there is also access list support, like this:
129
+### Fine-grained access control
130
101
-```
102
-[web]
103
- bind to = *
104
- allow connections from = localhost 10.* 192.168.*
105
-```
131
+If you want to keep using the local dashboard, but don't want it exposed to the internet, you can restrict access with
132
+[access lists](https://github.com/netdata/netdata/blob/master/web/server/README.md#access-lists). This method also fully retains the ability to stream metrics
133
+on-demand through Netdata Cloud.
134
107
-#### Fine-grained access control
135
+The `allow connections from` setting helps you allow only certain IP addresses or FQDN/hostnames, such as a trusted
136
+static IP, only `localhost`, or connections from behind a management LAN.
137
109
-The access list support allows filtering of all incoming connections, by specific IP addresses, ranges
110
-or validated DNS lookups. Only connections that match an entry on the list will be allowed:
138
+By default, this setting is `localhost *`. This setting allows connections from `localhost` in addition to _all_
139
+connections, using the `*` wildcard. You can change this setting using Netdata's [simple
140
+patterns](https://github.com/netdata/netdata/blob/master/libnetdata/simple_pattern/README.md).
141
112
-```
142
+```conf
143
[web]
114
- allow connections from = localhost 192.168.* 1.2.3.4 homeip.net
115
-```
116
-
117
-Connections from the IP addresses are allowed if the connection IP matches one of the patterns given.
118
-The alias localhost is always checked against 127.0.0.1, any other symbolic names need to resolve in
119
-both directions using DNS. In the above example the IP address of `homeip.net` must reverse DNS resolve
120
-to the incoming IP address and a DNS lookup on `homeip.net` must return the incoming IP address as
121
-one of the resolved addresses.
144
+ # Allow only localhost connections
145
+ allow connections from = localhost
146
123
-More specific control of what each incoming connection can do can be specified through the access control
124
-list settings:
147
+ # Allow only from management LAN running on `10.X.X.X`
148
+ allow connections from = 10.*
149
150
+ # Allow connections only from a specific FQDN/hostname
151
+ allow connections from = example*
152
```
153
+
154
+The `allow connections from` setting is global and restricts access to the dashboard, badges, streaming, API, and
155
+`netdata.conf`, but you can also set each of those access lists more granularly if you choose:
156
+
157
+```conf
158
[web]
128
- allow connections from = 160.1.*
129
- allow badges from = 160.1.1.2
130
- allow streaming from = 160.1.2.*
131
- allow management from = control.subnet.ip
132
- allow netdata.conf from = updates.subnet.ip
133
- allow dashboard from = frontend.subnet.ip
159
+ allow connections from = localhost *
160
+ allow dashboard from = localhost *
161
+ allow badges from = *
162
+ allow streaming from = *
163
+ allow netdata.conf from = localhost fd* 10.* 192.168.* 172.16.* 172.17.* 172.18.* 172.19.* 172.20.* 172.21.* 172.22.* 172.23.* 172.24.* 172.25.* 172.26.* 172.27.* 172.28.* 172.29.* 172.30.* 172.31.*
164
+ allow management from = localhost
165
```
166
136
-In this example only connections from `160.1.x.x` are allowed, only the specific IP address `160.1.1.2`
137
-can access badges, only IP addresses in the smaller range `160.1.2.x` can stream data. The three
138
-hostnames shown can access specific features, this assumes that DNS is setup to resolve these names
139
-to IP addresses within the `160.1.x.x` range and that reverse DNS is setup for these hosts.
140
-
167
+See the [web server](https://github.com/netdata/netdata/blob/master/web/server/README.md#access-lists) docs for additional details about access lists. You can take
168
+access lists one step further by [enabling SSL](https://github.com/netdata/netdata/blob/master/web/server/README.md#enabling-tls-support) to encrypt data from local
169
+dashboard in transit. The connection to Netdata Cloud is always secured with TLS.
170
142
-#### Use an authenticating web server in proxy mode
171
+### Use an authenticating web server in proxy mode
172
173
Use one web server to provide authentication in front of **all your Netdata servers**. So, you will be accessing all your Netdata with URLs like `http://{HOST}/netdata/{NETDATA_HOSTNAME}/` and authentication will be shared among all of them (you will sign-in once for all your servers). Instructions are provided on how to set the proxy configuration to have Netdata run behind [nginx](Running-behind-nginx.md), [Apache](Running-behind-apache.md), [lighttpd](Running-behind-lighttpd.md) and [Caddy](Running-behind-caddy.md).
174
@@ -193,15 +222,15 @@ _script to allow access to Netdata only from a number of hosts_
222
223
You can run the above any number of times. Each time it runs it refreshes the list of allowed hosts.
224
196
-#### Other methods
225
+### Other methods
226
227
Of course, there are many more methods you could use to protect Netdata:
228
200
-- bind Netdata to localhost and use `ssh -L 19998:127.0.0.1:19999 remote.netdata.ip` to forward connections of local port 19998 to remote port 19999. This way you can ssh to a Netdata server and then use `http://127.0.0.1:19998/` on your computer to access the remote Netdata dashboard.
229
+- Bind Netdata to localhost and use `ssh -L 19998:127.0.0.1:19999 remote.netdata.ip` to forward connections of local port 19998 to remote port 19999. This way you can ssh to a Netdata server and then use `http://127.0.0.1:19998/` on your computer to access the remote Netdata dashboard.
230
231
- If you are always under a static IP, you can use the script given above to allow direct access to your Netdata servers without authentication, from all your static IPs.
232
204
-- install all your Netdata in **headless data collector** mode, forwarding all metrics in real-time to a parent
233
+- Install all your Netdata in **headless data collector** mode, forwarding all metrics in real-time to a parent
234
Netdata server, which will be protected with authentication using an nginx server running locally at the parent
235
Netdata server. This requires more resources (you will need a bigger parent Netdata server), but does not require
236
any firewall changes, since all the child Netdata servers will not be listening for incoming connections.
docs/quickstart/infrastructure.md
+1
-1
@@ -133,7 +133,7 @@ sudo ./edit-config netdata.conf
133
Our [configuration basics doc](https://github.com/netdata/netdata/blob/master/docs/configure/nodes.md) contains more information about `netdata.conf`, `edit-config`,
134
along with simple examples to get you familiar with editing your node's configuration.
135
136
-After you've learned the basics, you should [secure your infrastructure's nodes](https://github.com/netdata/netdata/blob/master/docs/configure/secure-nodes.md) using
136
+After you've learned the basics, you should [secure your infrastructure's nodes](https://github.com/netdata/netdata/blob/master/docs/netdata-security.md) using
137
one of our recommended methods. These security best practices ensure no untrusted parties gain access to the metrics
138
collected on any of your nodes.
139