Consul: Securing Consul Web UI

[yakhyadabo]

I come from this thread.

My main concern is to know what's the proper way to secure the consul ui.
I've read the documentation and it's not mentioned anywhere.

[ashleyprimo]

You can enable mTLS on the web interface of Consul; see https://www.consul.io/docs/internals/security.html

[johncowen]

Hi @yakhyadabo

Thanks for the answer there @ashleyprimo !

Related to that, from looking at that thread you linked to, did you want to add a password to the Consul UI?

If so, we currently recommend running the UI behind a proxy with some sort of authentication on the proxy (so using nginx or similar). We have spoken amongst the team about potentially adding some sort of OAuth or similar to the UI itself (also see https://github.com/hashicorp/consul/issues/4367), but there is nothing super definite on that as yet. I'll update you here when I know more.

Thanks,

[yakhyadabo]

Ok @johncowen,

In the meanwhile I will be relying on ACLs to secure the UI.

Regards,

[johncowen]

Hey @yakhyadabo

If your UI installation will be available publicly please be aware that there is some information that cannot be restricted by ACLs, i.e. the names of your datacenters, the Consul version you are running.

If you are exposing the Consul API/UI publicly and you do not want that information exposed, we'd recommend putting an authentication proxy in front of it.

[yakhyadabo]

The cluster is not publicly exposed.