From aa9ef22dded962f5803b83c357fbf86ccef1d356 Mon Sep 17 00:00:00 2001 From: Vika Date: Mon, 13 Jun 2022 07:30:36 +0000 Subject: [PATCH] update wiki pages --- README.md | 18 ++++++++++-------- Single-server-VictoriaMetrics.md | 18 ++++++++++-------- 2 files changed, 20 insertions(+), 16 deletions(-) diff --git a/README.md b/README.md index 7f545f6..c920ad1 100644 --- a/README.md +++ b/README.md @@ -1359,8 +1359,13 @@ Additionally, alerting can be set up with the following tools: ## Security -Do not forget protecting sensitive endpoints in VictoriaMetrics when exposing it to untrusted networks such as the internet. -Consider setting the following command-line flags: +General security recommendations: + +- All the VictoriaMetrics components must run in protected private networks without direct access from untrusted networks such as Internet. The exception is [vmauth](https://docs.victoriametrics.com/vmauth.html) and [vmgateway](https://docs.victoriametrics.com/vmgateway.html). +- All the requests from untrusted networks to VictoriaMetrics components must go through auth proxy such as vmauth or vmgateway. The proxy must be set up with proper authentication and authorization. +- Prefer using lists of allowed API endpoints, while disallowing access to other endpoints when configuring auth proxy in front of VictoriaMetrics components. + +VictoriaMetrics provides the following security-related command-line flags: * `-tls`, `-tlsCertFile` and `-tlsKeyFile` for switching from HTTP to HTTPS. * `-httpAuth.username` and `-httpAuth.password` for protecting all the HTTP endpoints @@ -1370,14 +1375,11 @@ Consider setting the following command-line flags: * `-forceMergeAuthKey` for protecting `/internal/force_merge` endpoint. See [force merge docs](#forced-merge). * `-search.resetCacheAuthKey` for protecting `/internal/resetRollupResultCache` endpoint. See [backfilling](#backfilling) for more details. * `-configAuthKey` for protecting `/config` endpoint, since it may contain sensitive information such as passwords. - -- `-pprofAuthKey` for protecting `/debug/pprof/*` endpoints, which can be used for [profiling](#profiling). +* `-pprofAuthKey` for protecting `/debug/pprof/*` endpoints, which can be used for [profiling](#profiling). +* `-denyQueryTracing` for disallowing [query tracing](#query-tracing). Explicitly set internal network interface for TCP and UDP ports for data ingestion with Graphite and OpenTSDB formats. -For example, substitute `-graphiteListenAddr=:2003` with `-graphiteListenAddr=:2003`. - -Prefer authorizing all the incoming requests from untrusted networks with [vmauth](https://docs.victoriametrics.com/vmauth.html) -or similar auth proxy. +For example, substitute `-graphiteListenAddr=:2003` with `-graphiteListenAddr=:2003`. This protects from unexpected requests from untrusted network interfaces. ## Tuning diff --git a/Single-server-VictoriaMetrics.md b/Single-server-VictoriaMetrics.md index 0982df8..5f70ee3 100644 --- a/Single-server-VictoriaMetrics.md +++ b/Single-server-VictoriaMetrics.md @@ -1363,8 +1363,13 @@ Additionally, alerting can be set up with the following tools: ## Security -Do not forget protecting sensitive endpoints in VictoriaMetrics when exposing it to untrusted networks such as the internet. -Consider setting the following command-line flags: +General security recommendations: + +- All the VictoriaMetrics components must run in protected private networks without direct access from untrusted networks such as Internet. The exception is [vmauth](https://docs.victoriametrics.com/vmauth.html) and [vmgateway](https://docs.victoriametrics.com/vmgateway.html). +- All the requests from untrusted networks to VictoriaMetrics components must go through auth proxy such as vmauth or vmgateway. The proxy must be set up with proper authentication and authorization. +- Prefer using lists of allowed API endpoints, while disallowing access to other endpoints when configuring auth proxy in front of VictoriaMetrics components. + +VictoriaMetrics provides the following security-related command-line flags: * `-tls`, `-tlsCertFile` and `-tlsKeyFile` for switching from HTTP to HTTPS. * `-httpAuth.username` and `-httpAuth.password` for protecting all the HTTP endpoints @@ -1374,14 +1379,11 @@ Consider setting the following command-line flags: * `-forceMergeAuthKey` for protecting `/internal/force_merge` endpoint. See [force merge docs](#forced-merge). * `-search.resetCacheAuthKey` for protecting `/internal/resetRollupResultCache` endpoint. See [backfilling](#backfilling) for more details. * `-configAuthKey` for protecting `/config` endpoint, since it may contain sensitive information such as passwords. - -- `-pprofAuthKey` for protecting `/debug/pprof/*` endpoints, which can be used for [profiling](#profiling). +* `-pprofAuthKey` for protecting `/debug/pprof/*` endpoints, which can be used for [profiling](#profiling). +* `-denyQueryTracing` for disallowing [query tracing](#query-tracing). Explicitly set internal network interface for TCP and UDP ports for data ingestion with Graphite and OpenTSDB formats. -For example, substitute `-graphiteListenAddr=:2003` with `-graphiteListenAddr=:2003`. - -Prefer authorizing all the incoming requests from untrusted networks with [vmauth](https://docs.victoriametrics.com/vmauth.html) -or similar auth proxy. +For example, substitute `-graphiteListenAddr=:2003` with `-graphiteListenAddr=:2003`. This protects from unexpected requests from untrusted network interfaces. ## Tuning