Netdata Monitoring mit SSL Übertragung und Benutzer Authentifizierung via Nginx und ProxyPass

[h3rb3rn]

Fassung vom 29.07.2019

Netdata installieren

Quelle: https://github.com/netdata/netdata

Code: Select all

bash <(curl -Ss https://my-netdata.io/kickstart.sh)

NetData absichern

NetData Port 19999 binden an localhost (127.0.0.1)

Code: Select all

sudo sed -i 's/# bind to = \*/bind to \= 127.0.0.1\:19999/g' /etc/netdata/netdata.conf

Code: Select all

sudo systemctl restart netdata.service

NetData via Nginx mit ProxyPass und OpenSSL erreichbar machen

Nginx und Webserver Tools installieren

Code: Select all

apt install nginx openssl apache2-utils

Anlegen des selbst signierten TLS/SSL Zertifikates

Code: Select all

cd /etc/nginx/ssl/;
sudo openssl req -new -days 999 -newkey rsa:4096bits -sha512 -x509 -nodes -out netdata.crt -keyout netdata.key -subj "/C=DE/ST=Chaoszone/L=Cyberspace/O=4noobs/OU=Hosting/CN=netdata.4noobs.de"

Anlegen der .htaccess (ndwatch gegen den eigenen User austauschen)

Code: Select all

cd /etc/nginx/
sudo htpasswd -c /etc/nginx/.htpasswd ndwatch

anlegen der /etc/nginx/sites-available/netdata.conf (netdata.4noobs.de gegen die eigene Domain austauschen)

Code: Select all

server {
  server_name netdata.4noobs.de;

  listen 443 ssl;

  client_max_body_size 50m;

  location / {
    auth_basic "Restricted Content";
    auth_basic_user_file /etc/nginx/.htpasswd;
    proxy_pass http://127.0.0.1:19999;
    proxy_redirect off;
    proxy_http_version 1.1;
    proxy_set_header Connection "";
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $http_host;
    proxy_pass_header Access-Control-Allow-Origin;
    proxy_pass_header Access-Control-Allow-Methods;
    proxy_hide_header Access-Control-Allow-Headers;
    add_header Access-Control-Allow-Headers 'X-Requested-With, Content-Type';
    add_header Access-Control-Allow-Credentials true;
  }

  ssl_certificate /etc/nginx/ssl/netdata.crt;
  ssl_certificate_key /etc/nginx/ssl/netdata.key;

  ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256";
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_prefer_server_ciphers on;
  ssl_session_cache shared:SSL:10m;
  ssl_session_timeout 5m;
}

server {
    if ($host = netdata.4noobs.de) {
        return 301 https://$host$request_uri;
}

server_name netdata.4noobs.de;
  listen 80;
  return 404;
}

aktivieren der netdata.conf

Code: Select all

sudo ln -s /etc/nginx/sites-available/netdata.conf /etc/nginx/sites-enabled/

Nginx neustarten

Code: Select all

sudo systemctl restart nginx.service