Windows_exporter: TLS authentication?

[dimitertodorov]

Hi,

Have you thought about implementing TLS for the endpoint. I really would prefer to secure the metric endpoints at least with a client cert check.

I know it breaks the normal Prometheus pattern of doing authentication with a proxy.
But on Windows, we really don't have many options for lightweight proxy setup.

Shouldn't be too hard to implement, I could even take a look at writing a patch maybe.

D

[martinlindhe]

The prometheus docs explains:

Why don't the Prometheus server components support TLS or authentication? Can I add those?

While TLS and authentication are frequently requested features, we have intentionally not implemented
them in any of Prometheus's server-side components. There are so many different options and
parameters for both (10+ options for TLS alone) that we have decided to focus on building the best
monitoring system possible rather than supporting fully generic TLS and authentication solutions in
every server component.

If you need TLS or authentication, we recommend putting a reverse proxy in front of Prometheus.
See for example Adding Basic Auth to Prometheus with Nginx.

Note that this applies only to inbound connections. Prometheus does support scraping TLS- and
auth-enabled targets, and other Prometheus components that create outbound connections have similar
support.

Source: https://prometheus.io/docs/introduction/faq/#why-don%27t-the-prometheus-server-components-support-tls-or-authentication?-can-i-add-those?

Surely you can set up a reverse proxy with nginx on Windows too?
They provide Windows binaries, for example https://nginx.org/download/nginx-1.11.10.zip
and can be easily installed using scoop.sh or choco

[martinlindhe]

@brian-brazil Could you weight in on this please? Is it a reasonable idea to add tls support to this exporter given it is more hassle to set up a reverse-proxy in Windows land than in Linux? I've no strong opinion either way.

[brian-brazil]

We have no opinion on this for 3rd party integrations from the Prometheus side, we've just chosen not to do this ourselves and also none of us are Windows experts.

[martinlindhe]

@brian-brazil Okay thanks!

@dimitertodorov A patch is welcome if you want to have a go at this :-)

[carlpett]

@martinlindhe I'd be a bit wary of taking this on, for much the same reasons as in the docs. Maybe a very simple reverse proxy could be written side-by-side instead?

[martinlindhe]

@carlpett So your saying we should ship a reverse proxy binary with the project, or as a separate project?

[carlpett]

I think it should be a separate project. This looks like it might fit the bill with some extension for authentication?

[brian-brazil]

Have you looked at caddyserver?

[carlpett]

@brian-brazil Hadn't heard of it, but at first glance it looks just the thing!

[martinlindhe]

caddyserver is providing windows binaries on https://github.com/mholt/caddy/releases, i would +1 that :)

so maybe we can resolve this just by adding some docs on how to use caddyserver for this?

[dimitertodorov]

Thanks for pointing me to Caddy Server. That seems like a good option. I will take a look at it.
If I can get it working with this exporter I will share a doc.

[martinlindhe]

Please do!

[dimitertodorov]

At its most basic a Caddyfile like this does the trick. With wmi-exporter binding on 127.0.0.1:9182
Could also do basic auth, but seems to me like TLS is a more secure option.

itsdtojadim2012:2016

gzip
log    access.log
proxy  /metrics 127.0.0.1:9182

tls "c:/client/itsdtojadim2012.pem" "c:/client/itsdtojadim2012-key.pem" {
    clients "C:/client/intermediate_masters_ca.pem"
}

[martinlindhe]

@dimitertodorov Excellent!
I made a wiki based on this over here: https://github.com/martinlindhe/wmi_exporter/wiki/TLS-authentication

[carlpett]

@dimitertodorov Does your case need the browse and ext statements there? They enable file listings for the working directory where you start caddy, which could leak a lot of sensitive data depending how/where you start it (consider for example if you start it from the root of C:, anyone with access to the endpoint can then download your private key, as well as a lot of data from the Windows directory, etc).

I will adjust the wiki, at least, since it is not a safe general recommendation.

[stevelogik]

LOL it's insane there is no TLS or some sort of encryption option for the wmi exporter. I see that it was added for the linux node collector. Your only option for windows is to have an SSL encrypted website for each host and possibly adding a reverse proxy? That is ridiculous to ask of people. Without TLS or SSL support, Prometheus is worthless if you are trying to monitor data from multiple networks. Not sure why this hasn't been a high priority over the years. Without serious encryption options, Prometheus is a fun toy to mess around with. You can't take any product seriously that doesn't take security seriously these days.

[breed808]

Hi @stevelogik, TLS support was added in the recent v0.16.0 release. There's documentation in the project README and the exporter-toolkit library.

I'd ask that you be mindful that the project maintainers are all volunteers, and must balance project contributions with their professional and personal lives.
As always, we're more than happy to review and merge any Pull Requests for issues you might identify in the future.