NGINX as reverse proxy

Some exporters don’t support basic authentication and TLS encryption out of the box. To secure them you can use NGINX as reverse proxy.

To secure exporter it is recommended to use TLS connection and authentication.

To do it we need:

Generate certificate;
Generate password and its hash;
Install the NGINX reverse proxy;
Create configuration files for NGINX reverse proxy;
Run NGINX reverse proxy.

1. Generate certificate

Certificate generation can be interactive or non-interactive. For non-interactive method prepare certificate configuration in file in advance. Use your preferred text editor or run:

Bash

nano cert-config.cnf

In editor enter following data

Bash

[ req ]
default_bits           = 2048
default_md             = sha256
default_keyfile        = private.key
prompt                 = no
days                   = 365
distinguished_name     = req_distinguished_name
req_extensions         = v3_req

[ req_distinguished_name ]
# countryName: two letters country code
countryName            = US
stateOrProvinceName    = California
# locality name, e.g. city name
localityName           = San Francisco
organizationName       = MyOrganization
organizationalUnitName = MyOrganizationalUnit
# commonName: DNS name, hostname or IP address
commonName             = example.com
emailAddress           = admin@example.com

[ v3_req ]
keyUsage               = digitalSignature, keyEncipherment
extendedKeyUsage       = serverAuth, clientAuth

Update values for:

countryName - your country code according to ISO,
stateOrProvinceName - name of your state or province, optional, if not applicable - comment this line,
localityName - e.g. your city name,
commonName - DNS name, hostname or IP address,
emailAddress - your email address.

Generate self-signed certificate and set permissions

Fedora (RHEL, CentOS)

Bash

sudo openssl req -new -x509 -nodes -config cert-config.cnf \
        -keyout /etc/pki/tls/private/exporter.key -out /usr/share/pki/ca-trust-source/anchors/exporter.crt

Bash

sudo chown prometheus:prometheus /etc/pki/tls/private/exporter.key
sudo chmod 600 /etc/pki/tls/private/exporter.key

Debian (Ubuntu)

Bash

sudo openssl req -new -x509 -nodes -config cert-config.cnf \
        -keyout /etc/ssl/private/exporter.key -out /usr/local/share/ca-certificates/exporter.crt

Bash

sudo chown prometheus:prometheus /etc/ssl/private/exporter.key
sudo chmod 600 /etc/ssl/private/exporter.key

info You will be needed to enter created certificate during exporter configuration on I&B monitoring platform. To do following run command and then copy it output (including -----BEGIN CERTIFICATE----- … -----END CERTIFICATE----- rows) and paste into I&B monitoring platform configuration form.

Fedora (RHEL, CentOS)

Bash

cat /usr/share/pki/ca-trust-source/anchors/exporter.crt

Debian (Ubuntu)

Bash

cat /usr/local/share/ca-certificates/exporter.crt

2. Generate password and its hash

Generate password with pwmake tool.

info It is available in RHEL out of the box. For Ubuntu install it (if not already installed) with:

Bash

sudo apt install libpwquality-tools

Run

Bash

pwmake 104

From pwmake man page:
“The 64 bits should be adequate for applications where the attacker does not have direct access to the password hash file. For situations where the attacker might obtain direct access to the password hash or the password is used as an encryption key 80 to 128 bits should be used depending on your level of paranoia.”

This password will be needed for hash generation on next step and during exporter configuration on I&B monitoring platform.

Create hash for password with htpasswdtool.

If it is not already installed, do:

Fedora (RHEL, CentOS)

Bash

sudo dnf install httpd-tools

Debian (Ubuntu)

Bash

sudo apt install apache2-utils

To generate user and password hash file run:

Bash

htpasswd -cb /path/to/.htpasswd username password

Change owner to file .htpasswd

Bash

sudo chown www-data:www-data /path/to/.htpasswd

“www-data” its username and group that use nginx

3. Install NGINX reverse proxy

Fedora (RHEL, CentOS)

Bash

sudo dnf install nginx

Debian (Ubuntu)

Bash

sudo apt install nginx

4. Create configuration file

Use your preferred text editor or create file with configuration for exporter. Replace "exporter name" with name of exporter for which you are creating configuration.

Bash

sudo nano /etc/nginx/conf.d/"exporter name".conf

For example, sudo nano /etc/nginx/conf.d/pve.conf

past into editor

Fedora (RHEL, CentOS)

 server {
        listen 80;
        server_name your_dns_name;
        return 301 https://$host$request_uri; # Redirect HTTP to HTTPS
    }

    server {
        listen 443 ssl;
        server_name your_dns_name;

        ssl_certificate /usr/share/pki/ca-trust-source/anchors/exporter.crt;
        ssl_certificate_key /etc/ssl/private/exporter.key;

        location / {
            auth_basic "Restricted Access";
            auth_basic_user_file /path/to/.htpasswd;

            proxy_pass http://localhost:9221;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
    }

info Note: for certificate and key see path on step Generate certificate.

Debian (Ubuntu)

server {
        listen 80;
        server_name your_dns_name;
        return 301 https://$host$request_uri; # Redirect HTTP to HTTPS
    }

    server {
        listen 443 ssl;
        server_name your_dns_name;

        ssl_certificate /usr/local/share/ca-certificates/exporter.crt;
        ssl_certificate_key /etc/ssl/private/exporter.key;

        location / {
            auth_basic "Restricted Access";
            auth_basic_user_file /path/to/.htpasswd;

            proxy_pass http://localhost:9221;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
    }

info Note: for certificate and key see path on step Generate certificate.

Open file nginx.conf to add upstreaming

Bash

sudo nano /etc/nginx/nginx.conf

and paste after string

Bash

http {

on next empty string this block

Bash

upstream my_backend {
        server 127.0.0.1:9221; # Replace with your exporter address and port
        }

after this run

Bash

sudo systemctl restart nginx.service

after this command you not see nothing in output, its good

if you see errors, run

Bash

sudo journalctl -xeu nginx.service

and look in /var/log/nginx/error.log to