4 ms·

The only gripe I have with it is the approach to security, i.e. the lack of user accounts (even one). So you have to either block the stats by IP (who is doing

The only gripe I have with it is the approach to security, i.e. the lack of user accounts (even one). So you have to either block the stats by IP (who is doing it these days?) or use other workarounds like proxying by Nginx etc.

smarx007 6y ago
I have it listen on a loopback interface and do SSH port forwarding when I want to look at the stats. Nginx proxying with basic auth is a perfectly reasonable approach and not a workaround in my humble opinion. I would trust these two approaches more than an unknown mechanism in Netdata.
odyslam 6y ago
Using Netdata Cloud is a great way not to spend any time with that and access the Agent's dashboard through Netdata Cloud. We use WSS and MQTT, so it's super secure and lightweight. The data are streamed from the Agent directly to your browser via the cloud. Relevant docs: https://learn.netdata.cloud/docs/configure/secure-nodes#disable-the-local-dashboard https://learn.netdata.cloud/docs/configure/secure-nodes#disa...
- sammy2244 6y ago
  So the only convenient way to have security is to use the cloud version? Got it.
  - dvfjsdhgfv 6y ago
    > So the only convenient way to have security is to use the cloud version? Got it. I wouldn't formulate it that way, it's just a bit annoying for me to see this trend of not having even tiny bit of security built in and having to do extra work just to protect the dashboard. Just one admin account and a random generated password would be fine.
  - distantsounds 6y ago
    yes, because a 10 line nginx config with basic http auth is too difficult for a sysadmin to set up in conjunction with his systems monitoring tool stop being obtuse
    - dvfjsdhgfv 6y ago
      It's not that it's too difficult, but we were accustomed to having this functionality built in in similar products in the past, then things changed. When ELK first showed up there was a big wave of attacks on ELK servers because they were completely unsecured and at that time X-Pack Security was a paid add-on, they changed their mind later, some time after an open source solution appeared.
      - PixyMisa 6y ago
        Absolutely. It has to be there, and users have to be forced to configure it at install time. How many times do we need to repeat this mistake?
  - napsterbr 6y ago
    That's the key difference between self-hosted and SaaS. If you self-host, you are responsible for setting up the required infrastructure, taking care of updates, backups etc. If setting up a reverse proxy behind whatever monitoring you've got is too much, then yes, by all means use the SaaS offering -- but that's 100% the user responsibility, and there's no need to be snarky about it.
    - dvfjsdhgfv 6y ago
      > If you self-host, you are responsible for setting up the required infrastructure, taking care of updates, backups etc. Are you speaking about Netdata or in general? Because if the former, then at least the updates part is not true: the installation script turns out nightly updates (and telemetry). Frankly, the reason there is no basic auth is that Netdata doesn't use a third-party web server but a built-in one, so they would have to add this functionality.
tinco 6y ago
Workarounds like proxying by nginx is not a workaround, it's the industry standard way of managing access to services. It's both more convenient and more secure, a rare combination. More convenient because you can use your companies pre-existing authentication to authenticate the requests, and more secure because you're not having to manage separate passwords and user accounts.
- dvfjsdhgfv 6y ago
  I understand your opinion, but it's not like that everywhere. I work for many clients who have single servers or specific setups and having to configure Nginx is an extra step and an additional layer that could be made totally unnecessary by building in just one admin account and assigning a random password to it.
manos_saratsis 6y ago
You can use Netdata Cloud to have secure authenticated access to your single node dashboard. Data remain on your systems and are streamed to your browser. Netdata Cloud stores only metadata.

smarx007 6y ago

I have it listen on a loopback interface and do SSH port forwarding when I want to look at the stats. Nginx proxying with basic auth is a perfectly reasonable approach and not a workaround in my humble opinion. I would trust these two approaches more than an unknown mechanism in Netdata.

odyslam 6y ago

Using Netdata Cloud is a great way not to spend any time with that and access the Agent's dashboard through Netdata Cloud. We use WSS and MQTT, so it's super secure and lightweight. The data are streamed from the Agent directly to your browser via the cloud. Relevant docs: https://learn.netdata.cloud/docs/configure/secure-nodes#disable-the-local-dashboard https://learn.netdata.cloud/docs/configure/secure-nodes#disa...

sammy2244 6y ago
So the only convenient way to have security is to use the cloud version? Got it.
- dvfjsdhgfv 6y ago
  > So the only convenient way to have security is to use the cloud version? Got it. I wouldn't formulate it that way, it's just a bit annoying for me to see this trend of not having even tiny bit of security built in and having to do extra work just to protect the dashboard. Just one admin account and a random generated password would be fine.
- distantsounds 6y ago
  yes, because a 10 line nginx config with basic http auth is too difficult for a sysadmin to set up in conjunction with his systems monitoring tool stop being obtuse
  - dvfjsdhgfv 6y ago
    It's not that it's too difficult, but we were accustomed to having this functionality built in in similar products in the past, then things changed. When ELK first showed up there was a big wave of attacks on ELK servers because they were completely unsecured and at that time X-Pack Security was a paid add-on, they changed their mind later, some time after an open source solution appeared.
    - PixyMisa 6y ago
      Absolutely. It has to be there, and users have to be forced to configure it at install time. How many times do we need to repeat this mistake?
- napsterbr 6y ago
  That's the key difference between self-hosted and SaaS. If you self-host, you are responsible for setting up the required infrastructure, taking care of updates, backups etc. If setting up a reverse proxy behind whatever monitoring you've got is too much, then yes, by all means use the SaaS offering -- but that's 100% the user responsibility, and there's no need to be snarky about it.
  - dvfjsdhgfv 6y ago
    > If you self-host, you are responsible for setting up the required infrastructure, taking care of updates, backups etc. Are you speaking about Netdata or in general? Because if the former, then at least the updates part is not true: the installation script turns out nightly updates (and telemetry). Frankly, the reason there is no basic auth is that Netdata doesn't use a third-party web server but a built-in one, so they would have to add this functionality.

tinco 6y ago

Workarounds like proxying by nginx is not a workaround, it's the industry standard way of managing access to services. It's both more convenient and more secure, a rare combination. More convenient because you can use your companies pre-existing authentication to authenticate the requests, and more secure because you're not having to manage separate passwords and user accounts.

dvfjsdhgfv 6y ago
I understand your opinion, but it's not like that everywhere. I work for many clients who have single servers or specific setups and having to configure Nginx is an extra step and an additional layer that could be made totally unnecessary by building in just one admin account and assigning a random password to it.

manos_saratsis 6y ago

You can use Netdata Cloud to have secure authenticated access to your single node dashboard. Data remain on your systems and are streamed to your browser. Netdata Cloud stores only metadata.