From 92a549bccbf8ca7b5104ff7d56f864f58754e182 Mon Sep 17 00:00:00 2001 From: Aliaksandr Valialkin Date: Mon, 8 May 2023 13:35:37 -0700 Subject: [PATCH] app/vmauth/README.md: mention about ip filters and concurrency limiter at Security chapter --- app/vmauth/README.md | 4 +++- docs/vmauth.md | 4 +++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/app/vmauth/README.md b/app/vmauth/README.md index 801f96fa7..4ff8c1e1f 100644 --- a/app/vmauth/README.md +++ b/app/vmauth/README.md @@ -253,12 +253,14 @@ Do not transfer Basic Auth headers in plaintext over untrusted networks. Enable Alternatively, [https termination proxy](https://en.wikipedia.org/wiki/TLS_termination_proxy) may be put in front of `vmauth`. -It is recommended protecting following endpoints with authKeys: +It is recommended protecting the following endpoints with authKeys: * `/-/reload` with `-reloadAuthKey` command-line flag, so external users couldn't trigger config reload. * `/flags` with `-flagsAuthkey` command-line flag, so unauthorized users couldn't get application command-line flags. * `/metrics` with `metricsAuthkey` command-line flag, so unauthorized users couldn't get access to [vmauth metrics](#monitoring). * `/debug/pprof` with `pprofAuthKey` command-line flag, so unauthorized users couldn't get access to [profiling information](#profiling). +`vmauth` also supports the ability to restict access by IP - see [these docs](#ip-filters). See also [concurrency limiting docs](#concurrency-limiting). + ## Monitoring `vmauth` exports various metrics in Prometheus exposition format at `http://vmauth-host:8427/metrics` page. It is recommended setting up regular scraping of this page diff --git a/docs/vmauth.md b/docs/vmauth.md index b044163b2..fab0d7076 100644 --- a/docs/vmauth.md +++ b/docs/vmauth.md @@ -257,12 +257,14 @@ Do not transfer Basic Auth headers in plaintext over untrusted networks. Enable Alternatively, [https termination proxy](https://en.wikipedia.org/wiki/TLS_termination_proxy) may be put in front of `vmauth`. -It is recommended protecting following endpoints with authKeys: +It is recommended protecting the following endpoints with authKeys: * `/-/reload` with `-reloadAuthKey` command-line flag, so external users couldn't trigger config reload. * `/flags` with `-flagsAuthkey` command-line flag, so unauthorized users couldn't get application command-line flags. * `/metrics` with `metricsAuthkey` command-line flag, so unauthorized users couldn't get access to [vmauth metrics](#monitoring). * `/debug/pprof` with `pprofAuthKey` command-line flag, so unauthorized users couldn't get access to [profiling information](#profiling). +`vmauth` also supports the ability to restict access by IP - see [these docs](#ip-filters). See also [concurrency limiting docs](#concurrency-limiting). + ## Monitoring `vmauth` exports various metrics in Prometheus exposition format at `http://vmauth-host:8427/metrics` page. It is recommended setting up regular scraping of this page