Skip to content

Add option to whitelist ports #26

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Conversation

sezuan
Copy link

@sezuan sezuan commented Jul 27, 2018

Maybe it makes sense to whitelist ports on each client which knows the local exporters instead of maintaining large ACLs on a proxy.

@brian-brazil
Copy link
Contributor

What is the attack vector you are worried about?

@sezuan
Copy link
Author

sezuan commented Jul 27, 2018

As far as I understood, anyone who can connect to the proxy can connect to arbitrary ports on the client. In that case it might be possible to bypass ip based firewalls since the connection comes from localhost.

@brian-brazil
Copy link
Contributor

We generally don't provide auth mechanisms in Prometheus components, as there's just too many ways to do this. I'd suggest locking down the proxy or taking advantage of the fact that iptables can use uids.

@sezuan
Copy link
Author

sezuan commented Jul 30, 2018

Okay, thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants