diff --git a/README.md b/README.md index ae04f38da..835319a1c 100644 --- a/README.md +++ b/README.md @@ -1392,6 +1392,7 @@ VictoriaMetrics provides the following security-related command-line flags: * `-forceMergeAuthKey` for protecting `/internal/force_merge` endpoint. See [force merge docs](#forced-merge). * `-search.resetCacheAuthKey` for protecting `/internal/resetRollupResultCache` endpoint. See [backfilling](#backfilling) for more details. * `-configAuthKey` for protecting `/config` endpoint, since it may contain sensitive information such as passwords. +* `-flagsAuthKey` for protecting `/flags` endpoint. * `-pprofAuthKey` for protecting `/debug/pprof/*` endpoints, which can be used for [profiling](#profiling). * `-denyQueryTracing` for disallowing [query tracing](#query-tracing). diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index eb672322c..315c712c0 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -17,7 +17,7 @@ The following tip changes can be tested by building VictoriaMetrics components f **Update notes:** this release introduces backwards-incompatible changes to communication protocol between `vmselect` and `vmstorage` nodes in cluster version of VictoriaMetrics because of added [query tracing](https://docs.victoriametrics.com/Single-server-VictoriaMetrics.html#query-tracing), so `vmselect` and `vmstorage` nodes may log communication errors during the upgrade. These errors should stop after all the `vmselect` and `vmstorage` nodes are updated to new release. It is safe to downgrade to previous releases. -* SECURITY: Adds `flagsAuthKey` command-line flag, which protects `/flags` endpoint and prevents application configuration disclosure. See [This issue](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/2753). +* SECURITY: add `-flagsAuthKey` command-line flag for protecting `/flags` endpoint from unauthorized access. Though this endpoint already hides values for command-line flags with `key` and `password` substrings in their names, other sensitive information could be exposed there. See [This issue](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/2753). * FEATURE: support query tracing, which allows determining bottlenecks during query processing. See [these docs](https://docs.victoriametrics.com/Single-server-VictoriaMetrics.html#query-tracing) and [this feature request](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/1403). * FEATURE: [vmui](https://docs.victoriametrics.com/#vmui): add `cardinality` tab, which can help identifying the source of [high cardinality](https://docs.victoriametrics.com/FAQ.html#what-is-high-cardinality) and [high churn rate](https://docs.victoriametrics.com/FAQ.html#what-is-high-churn-rate) issues. See [this](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/2233) and [this](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/2730) feature requests and [these docs](https://docs.victoriametrics.com/#cardinality-explorer). diff --git a/docs/README.md b/docs/README.md index ae04f38da..835319a1c 100644 --- a/docs/README.md +++ b/docs/README.md @@ -1392,6 +1392,7 @@ VictoriaMetrics provides the following security-related command-line flags: * `-forceMergeAuthKey` for protecting `/internal/force_merge` endpoint. See [force merge docs](#forced-merge). * `-search.resetCacheAuthKey` for protecting `/internal/resetRollupResultCache` endpoint. See [backfilling](#backfilling) for more details. * `-configAuthKey` for protecting `/config` endpoint, since it may contain sensitive information such as passwords. +* `-flagsAuthKey` for protecting `/flags` endpoint. * `-pprofAuthKey` for protecting `/debug/pprof/*` endpoints, which can be used for [profiling](#profiling). * `-denyQueryTracing` for disallowing [query tracing](#query-tracing). diff --git a/docs/Single-server-VictoriaMetrics.md b/docs/Single-server-VictoriaMetrics.md index 2a8f1988b..bb2b63432 100644 --- a/docs/Single-server-VictoriaMetrics.md +++ b/docs/Single-server-VictoriaMetrics.md @@ -1396,6 +1396,7 @@ VictoriaMetrics provides the following security-related command-line flags: * `-forceMergeAuthKey` for protecting `/internal/force_merge` endpoint. See [force merge docs](#forced-merge). * `-search.resetCacheAuthKey` for protecting `/internal/resetRollupResultCache` endpoint. See [backfilling](#backfilling) for more details. * `-configAuthKey` for protecting `/config` endpoint, since it may contain sensitive information such as passwords. +* `-flagsAuthKey` for protecting `/flags` endpoint. * `-pprofAuthKey` for protecting `/debug/pprof/*` endpoints, which can be used for [profiling](#profiling). * `-denyQueryTracing` for disallowing [query tracing](#query-tracing). diff --git a/docs/vmauth.md b/docs/vmauth.md index cde085e93..43dfef8be 100644 --- a/docs/vmauth.md +++ b/docs/vmauth.md @@ -146,9 +146,9 @@ Alternatively, [https termination proxy](https://en.wikipedia.org/wiki/TLS_termi It is recommended protecting following endpoints with authKeys: * `/-/reload` with `-reloadAuthKey` command-line flag, so external users couldn't trigger config reload. -* `/flags` with `flagsAuthkey` command-line flag, so external users couldn't get application configuriton. -* `/metrics` with `metricsAuthkey` command-line flag, so external users couldn't get application metrics. -* `/debug/pprof` with `pprofAuthKey` command-line flag, so external users couldn't get access to application profiling information. +* `/flags` with `-flagsAuthkey` command-line flag, so unauthorized users couldn't get application command-line flags. +* `/metrics` with `metricsAuthkey` command-line flag, so unauthorized users couldn't get access to [vmauth metrics](#monitoring). +* `/debug/pprof` with `pprofAuthKey` command-line flag, so unauthorized users couldn't get access to [profiling information](#profiling). ## Monitoring diff --git a/lib/httpserver/httpserver.go b/lib/httpserver/httpserver.go index 381ea1547..ddd3352e9 100644 --- a/lib/httpserver/httpserver.go +++ b/lib/httpserver/httpserver.go @@ -40,16 +40,15 @@ var ( "See https://www.robustperception.io/using-external-urls-and-proxies-with-prometheus") httpAuthUsername = flag.String("httpAuth.username", "", "Username for HTTP Basic Auth. The authentication is disabled if empty. See also -httpAuth.password") httpAuthPassword = flag.String("httpAuth.password", "", "Password for HTTP Basic Auth. The authentication is disabled if -httpAuth.username is empty") - metricsAuthKey = flag.String("metricsAuthKey", "", "Auth key for /metrics. It must be passed via authKey query arg. It overrides httpAuth.* settings") - pprofAuthKey = flag.String("pprofAuthKey", "", "Auth key for /debug/pprof. It must be passed via authKey query arg. It overrides httpAuth.* settings") + metricsAuthKey = flag.String("metricsAuthKey", "", "Auth key for /metrics endpoint. It must be passed via authKey query arg. It overrides httpAuth.* settings") + flagsAuthKey = flag.String("flagsAuthKey", "", "Auth key for /flags endpoint. It must be passed via authKey query arg. It overrides httpAuth.* settings") + pprofAuthKey = flag.String("pprofAuthKey", "", "Auth key for /debug/pprof/* endpoints. It must be passed via authKey query arg. It overrides httpAuth.* settings") disableResponseCompression = flag.Bool("http.disableResponseCompression", false, "Disable compression of HTTP responses to save CPU resources. By default compression is enabled to save network bandwidth") maxGracefulShutdownDuration = flag.Duration("http.maxGracefulShutdownDuration", 7*time.Second, `The maximum duration for a graceful shutdown of the HTTP server. A highly loaded server may require increased value for a graceful shutdown`) shutdownDelay = flag.Duration("http.shutdownDelay", 0, `Optional delay before http server shutdown. During this delay, the server returns non-OK responses from /health page, so load balancers can route new requests to other servers`) idleConnTimeout = flag.Duration("http.idleConnTimeout", time.Minute, "Timeout for incoming idle http connections") connTimeout = flag.Duration("http.connTimeout", 2*time.Minute, `Incoming http connections are closed after the configured timeout. This may help to spread the incoming load among a cluster of services behind a load balancer. Please note that the real timeout may be bigger by up to 10% as a protection against the thundering herd problem`) - - flagsAuthKey = flag.String("flagsAuthKey", "", "Auth key for /flags endpoint. It must be passed via authKey query arg. It overrides httpAuth.* settings") ) var (