Authentication

To secure exporter it is recommended to use TLS connection and authentication.

To do it we need:

Generate certificate;
Generate password and its hash;
Create configuration file.

1. Generate certificate

Certificate generation can be interactive or non-interactive. For non non-interactive method prepare certificate configuration in file in advance. Use your preferred text editor or run:

Bash

nano cert-config.cnf

In editor enter following data

Bash

[ req ]
default_bits           = 2048
default_md             = sha256
default_keyfile        = private.key
prompt                 = no
days                   = 365
distinguished_name     = req_distinguished_name
req_extensions         = v3_req

[ req_distinguished_name ]
# countryName: two letters country code
countryName            = US
stateOrProvinceName    = California
# locality name, e.g. city name
localityName           = San Francisco
organizationName       = MyOrganization
organizationalUnitName = MyOrganizationalUnit
# commonName: DNS name, hostname or IP address
commonName             = example.com
emailAddress           = admin@example.com

[ v3_req ]
keyUsage               = digitalSignature, keyEncipherment
extendedKeyUsage       = serverAuth, clientAuth

Update values for:

countryName - your country code according to ISO,
stateOrProvinceName - name of your state or province, optional, if not applicable - comment this line,
localityName - e.g. your city name,
commonName - DNS name, hostname or IP address,
emailAddress - your email address.

Generate self-signed certificate and set permissions

Fedora (RHEL, CentOS)

Bash

sudo openssl req -new -x509 -nodes -config cert-config.cnf \
        -keyout /etc/pki/tls/private/exporter.key -out /usr/share/pki/ca-trust-source/anchors/exporter.crt

Bash

sudo chown prometheus:prometheus /etc/pki/tls/private/exporter.key
sudo chmod 600 /etc/pki/tls/private/exporter.key

Debian (Ubuntu)

Bash

sudo openssl req -new -x509 -nodes -config cert-config.cnf \
        -keyout /etc/ssl/private/exporter.key -out /usr/local/share/ca-certificates/exporter.crt

Bash

sudo chown prometheus:prometheus /etc/ssl/private/exporter.key
sudo chmod 600 /etc/ssl/private/exporter.key

info You will be needed to enter created certificate during exporter configuration on I&B monitoring platform. To do following run command and then copy it output (including -----BEGIN CERTIFICATE----- … -----END CERTIFICATE----- rows) and paste into I&B monitoring platform configuration form.

Fedora (RHEL, CentOS)

Bash

cat /usr/share/pki/ca-trust-source/anchors/exporter.crt

Debian (Ubuntu)

Bash

cat /usr/local/share/ca-certificates/exporter.crt

2. Generate password and its hash

Generate password with pwmake tool.

info It is available in RHEL out of the box. For Ubuntu install it (if not already installed) with:

Bash

sudo apt install libpwquality-tools

Run

Bash

pwmake 104

From pwmake man page:
“The 64 bits should be adequate for applications where the attacker does not have direct access to the password hash file. For situations where the attacker might obtain the direct access to the password hash or the password is used as an encryption key 80 to 128 bits should be used depending on your level of paranoia.”

This password will be needed for hash generation on next step and during exporter configuration on I&B monitoring platform.

Create hash for password with htpasswdtool.

If it is not already installed, install do:

Fedora (RHEL, CentOS)

Bash

sudo dnf install httpd-tools

Debian (Ubuntu)

Bash

sudo apt install apache2-utils

To generate hash run:

Bash

htpasswd -nbBC 10 "" "your password" | tr -d ':'

Output of this command will be needed on next step.

3. Create configuration file

Use your preferable text editor or create file with authentication configuration for exporter. Replace "exporter name" with name of exporter for which you are creating configuration.

Bash

sudo nano /usr/local/bin/"exporter name"/web-config.yml

For example, sudo nano /usr/local/bin/pushgateway/web-config.yml

past into editor and replace:

your_exporter_user - with your exporter’s user name
your password hash - with hash generated on previous step

Fedora (RHEL, CentOS)

tls_server_config:
  cert_file: /usr/share/pki/ca-trust-source/anchors/exporter.crt
  key_file: /etc/pki/tls/private/exporter.key
basic_auth_users:
  your_exporter_user: your password hash

info Note: for certificate and key see path on step Generate certificate.

Debian (Ubuntu)

tls_server_config:
  cert_file: /usr/local/share/ca-certificates/exporter.crt
  key_file: /etc/ssl/private/exporter.key
basic_auth_users:
  your_exporter_user: your password hash

info Note: for certificate and key see path on step Generate certificate.

Check configuration

To check authentication for exporter run

Bash

sudo /usr/local/bin/"exporter name"/"exporter name" --web.config.file=/usr/local/bin/"exporter name"/web-config.yml

for example:

sudo /usr/local/bin/pushgateway/pushgateway --web.config.file=/usr/local/bin/pushgateway/web-config.yml

In output you will see:

... msg="TLS is enabled." ...

Check with browser if it is accessible at https://resource-hostname-or-ip:port-number/metrics

After entering exporter’s user name and password you should see page like this:

# HELP go_gc_duration_seconds A summary of the wall-time pause (stop-the-world) duration in garbage collection cycles.
# TYPE go_gc_duration_seconds summary
go_gc_duration_seconds{quantile="0"} 2.2622e-05
...