Kapacitor: Securing access to Kapacitor / Configuring authentication

Created on 17 Jul 2017 · 6Comments · Source: influxdata/kapacitor

The documentation makes no mention as to how to enable authentication on Kapacitor. The auto-generated configuration however has an option for it:

[http]
  auth-enabled = false

I wish to run Kapacitor in a hostile environment and manage it remotely. Therefor I need some form of authentication. Chronograf also seems to have options for specifying credentials to use with Kapacitor.

How are these credentials configured? Does this feature even exist?
If not, is it possible to use a reverse-proxy with basic auth infront of Kapacitor?

Source

davidhiendl

👍13

Most helpful comment

Thanks for the reply. Since other influxdata products support authentication, I wonder what the rationale is for this? Is remote access to kapacitor an unusual use case?

MisterMartin on 11 Nov 2017

👍7

All 6 comments

Sorry for the belayed response, this slipped under my radar.

Open source Kapacitor does not have authentication support. This is a premium feature.

If not, is it possible to use a reverse-proxy with basic auth infront of Kapacitor?

Yes, its should be possible to setup a reverse proxy for the purpose of authenticating Kapacitor.

nathanielc on 9 Nov 2017

Thanks for the reply. Since other influxdata products support authentication, I wonder what the rationale is for this? Is remote access to kapacitor an unusual use case?

MisterMartin on 11 Nov 2017

👍7

I use an SSH tunnel to work around this limitation.

ssh user@influxserver -T -L9092:localhost:9092

After running that and leaving it running I can run kapacitor locally and it connects to kapacitord on the influxserver.

AdamSLevy on 11 Jan 2018

Hello,
Have there been any updates such that we'd be able to run Kapacitor and evaluate real-time data streams?

@dsarahstamps @mistermartin @daniels303

thaovytnguyen on 4 Oct 2018

To be frank, this is really bad, and even worse that the username/password that can be specified are not even checked (#1669). Considering that the Kapacitor user for influx has to be admin for the subscription, combined with the fact that you can't even get a simple user/password security in it, virtually means that Kapacitor allows you to do whatever you want in InfluxDB as long as you can get access to its Kapacitor port! For me that implies running Kapacitor is a security risk.