Netdata is great free tool for generating server statistics. By default it’s open for entire world on port 19999 – http://servername.com:19999. It is not a good idea to leave this open so everyone can your system statistics.
One way to limit access from where it is accessible is by editing netdata.conf and specify IPS in “allow connections from” variable.
[web]
allow connections from = ip's that are allowed to access>
There is no option to password protect it. This can be done with NGINX. You can create reverse proxy, so that nginx will serve content from netdata application. To make netdata accessible on subfolder of your hostname, eg. http://my.hostname.com/netdata, then create nginx configuration like bellow.
First generate password file for nginx:
htpasswd -c /etc/nginx/.htpasswd "username"
Then create or edit existing nginx configuration to something like this:
upstream netdata {
server 127.0.0.1:19999;
keepalive 64;
}
server {
listen 443 ssl http2;
server_name my.hostname.com;
location = /netdata {
return 301 /netdata/;
}
location ~ /netdata/(?.*) {
auth_basic "Restricted Content";
auth_basic_user_file /etc/nginx/.htpasswd;
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_http_version 1.1;
proxy_pass_request_headers on;
proxy_set_header Connection "keep-alive";
proxy_store off;
proxy_pass http://netdata/$ndpath$is_args$args;
gzip on;
gzip_proxied any;
gzip_types *;
}
error_log /var/log/nginx/error.log;
access_log off;
....
Also, don’t forget to edit netdata.conf and change some variables. Make netdata accessible only from localhost (nginx):
[web]
bind to = 127.0.0.1
allow connections from = localhost
allow dashboard from = localhost
You should also allow connection to port 19999 only to local traffic (localhost).
Restart nginx and netdata, then try to access like: http(s)://my.hostname.com/netdata.
If you’re getting error like bellow in your nginx error log, than chances are that SELinux is active. Disable selinux or execute this command “setsebool -P httpd_can_network_connect true”.
[crit] 8411#0: *1 connect() to 127.0.0.1:19999 failed (13: Permission denied) while connecting to upstream, client: 8.8.8.8, server: my.hostname.com, request: "GET /netdata/ HTTP/1.1", upstream: "http://127.0.0.1:19999/", host: "my.hostname.com"
Recent Comments