Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

How do I use functions without having to sign in?#17594

Unanswered
squeaktoy asked this question inQ&A
Discussion options

I'm running Netdata in my own local network, yet the web UI says the following on some tabs like Top:

Sign in to Netdata to use this function
Functions expose sensitive information about your systems and applications. To protect your privacy, Netdata exposes this information only to logged-in users and claimed agents. When viewing Functions directly on a Netdata Agent UI, this information is sent directly from the Netdata Agent to your web browser, without exposing it to any third parties.

I'm on my local network, so why is Netdata stopping me from viewing info about my own computer? How can I disable this requirement to sign in? I don't want to have an account on a third-party server just to view my own computer's information.

It also says something about "claimed agents". I tried thenetdata-claim.sh script, but it says:

This agent was built with --disable-cloud and cannot be claimed

So how am I going to use Netdata functions now without Cloud support? I would rather not connect to third-party servers. Anyone have an idea what to do here?

You must be logged in to vote

Replies: 8 comments 9 replies

Comment options

ilyam8
May 6, 2024
Collaborator

Hi,@squeaktoy. Not all functions require Cloud connection, seeAvailable Functions (Require Cloud column).

It also says something about "claimed agents". I tried the netdata-claim.sh script, but it says:

What is your Netdata version? Can you show/usr/sbin/netdata -W buildinfo (or/opt/netdata/usr/sbin/netdata -W buildinfo depends on your install prefix).

There was a bug in a nightly version but it wasfixed over a week ago.

You must be logged in to vote
7 replies
@squeaktoy
Comment options

After updating to 1..45.4, I still cannot use thenetdata-claim.sh script

@gurka
Comment options

Not all functions require Cloud connection, seeAvailable Functions (Require Cloud column).

There it says:

Since these functions are able to execute routines on the node and due to the potential use cases that they can cover, our concern is to ensure no sensitive information or disruptive actions are exposed through the Agent's API.

I don't understand this. For example, both the Processes and Systemd-journal functions should be strictly read-only - so why is there a concern about "executing routines on the node"? Why doesn't other functions, like Block-devices or Mount-points, have this "problem"?

It feels like some functions are just arbitrary set to require Cloud, just to force people to create and connect their local nodes to a Cloud account...

Edit: additionally, "Processes", which requires Cloud, is handled by the plugin "apps". The documentation of "apps" even says:

Security

apps.plugin performs a hard-coded function of building the process tree in memory, iterating forever, collecting metrics for each running process and sending them to Netdata. This is a one-way communication, from apps.plugin to Netdata.

So, since apps.plugin cannot be instructed by Netdata for the actions it performs, we think it is pretty safe to allow it to have these increased privileges.

(https://github.com/netdata/netdata/tree/master/src/collectors/apps.plugin#security)

@Ou7law007
Comment options

Just like most open source services, if it was actually "for security purposes", they can literally make it possible to register a local account and solve the entire issue once and for all.

@Ou7law007
Comment options

Having to register your account ON THE CLOUD on its own is a bigf*ck you to security.

@MNLierman
Comment options

Having to register your account ON THE CLOUD on its own is a bigf*ck you to security.

^^ This. Might seem blunt but how true it is, honestly. I emailed Netdata using their Contact Us option – a few reps on Reddit said invite people wanting to discuss plan options and figure out s solution that works for them to use the contact form. I did so, and gave my argument, including my willingness to agree to create a Netdata Cloud account and link up my devices, IF I could secure my account with additional layers or security and also be able to link up all of my local devices under their free plan. 2 weeks later, I have not received a reply.

They're milking home users who probably aren't even their big money makers, and all of this new required plan stuff wasn't a thing a few years ago. If I was making money off their products, sure, I'll pay for it then, but I don't. I barely make enough money to pay myself, and some months, I don't even have money to do that.

One of the reps, somewhere on Reddit, had stated sometime ago, that Netdata is open source and anyone can modify the code, and for that matter, I could create my own account service. Yeah, ok, because I have that level of programming experience to roll my own accounts solution.

Comment options

Can we have any way (runtime is preferred, but compile time is also OK) to force-allow access to local functions like systemd-journald? This function can be disabled by default, but overridable with sudo rights.

You must be logged in to vote
0 replies
Comment options

any updates?

You must be logged in to vote
0 replies
Comment options

for real like forcing us to use their cloud services, like i can just go use a different metric monitoring, well time to uninstall.

You must be logged in to vote
0 replies
Comment options

Bump!

You must be logged in to vote
0 replies
Comment options

I've also been troubled by this issue and found a possible workaround.

You need to fork the netdata code, modify thesrc/database/rrdfunctions-inflight.c file, remove the relevant permission checks, and then compile it. Like this:

diff --git a/src/database/rrdfunctions-inflight.c b/src/database/rrdfunctions-inflight.cindex a14234bff431c5..885960b283d26c 100644--- a/src/database/rrdfunctions-inflight.c+++ b/src/database/rrdfunctions-inflight.c@@ -438,48 +438,6 @@ int rrd_function_run(RRDHOST *host, BUFFER *result_wb, int timeout_s,         return code;     }-    if(!http_access_user_has_enough_access_level_for_endpoint(user_access, rdcf->access)) {--        if((rdcf->access & HTTP_ACCESS_SIGNED_ID) && !(user_access & HTTP_ACCESS_SIGNED_ID))-            code = rrd_call_function_error(result_wb,-                                           "You need to be authenticated via Netdata Cloud Single-Sign-On (SSO) "-                                           "to access this feature. Sign-in on this dashboard, "-                                           "or access your Netdata via https://app.netdata.cloud.",-                                           HTTP_ACCESS_PERMISSION_DENIED_HTTP_CODE(user_access));--        else if((rdcf->access & HTTP_ACCESS_SAME_SPACE) && !(user_access & HTTP_ACCESS_SAME_SPACE))-            code = rrd_call_function_error(result_wb,-                                           "You need to login to the Netdata Cloud space this agent is claimed to, "-                                           "to access this feature.",-                                           HTTP_ACCESS_PERMISSION_DENIED_HTTP_CODE(user_access));--        else if((rdcf->access & HTTP_ACCESS_COMMERCIAL_SPACE) && !(user_access & HTTP_ACCESS_COMMERCIAL_SPACE))-            code = rrd_call_function_error(result_wb,-                                           "This feature is only available for commercial users and supporters "-                                           "of Netdata. To use it, please upgrade your space. "-                                           "Thank you for supporting Netdata.",-                                           HTTP_ACCESS_PERMISSION_DENIED_HTTP_CODE(user_access));--        else {-            HTTP_ACCESS missing_access = (~user_access) & rdcf->access;-            char perms_str[1024];-            http_access2txt(perms_str, sizeof(perms_str), ", ", missing_access);--            char msg[2048];-            snprintfz(msg, sizeof(msg), "This feature requires additional permissions: %s.", perms_str);--            code = rrd_call_function_error(result_wb, msg,-                                           HTTP_ACCESS_PERMISSION_DENIED_HTTP_CODE(user_access));-        }--        dictionary_acquired_item_release(host->functions, host_function_acquired);--        if(result_cb)-            result_cb(result_wb, code, result_cb_data);--        return code;-    }-     if(timeout_s <= 0)         timeout_s = rdcf->timeout;

Configuring a complete build and packaging environment is cumbersome, but the compilation process can be handled on GitHub Actions. Although the pipeline may fail due to the absence of an official GPG key, you can still download the compiled deb package, like:https://github.com/lyc8503/netdata/actions/runs/17618181095/job/50056891375

Two important points to note:

  1. After removing permission checks, anyone can directly access features on the Dashboard. You must add password protection using a reverse proxy or employ methods like SSH forwarding to ensure only you can access the Dashboard.
  2. The check forHTTP_ACCESS_COMMERCIAL_SPACE is also removed, which appears to bypass the paywall. However, in my brief testing, I found this does not actually do anything. The existing AI insights premium features remain online and still require payment to use. To put it another way, undoubtedly, users have the freedom to modify the Netdata Agent released under the GPL-3.0 license.
    The only cause for concern is that the Netdata UI (dashboard frontend) is released under anon-free license, and it mentionsThis license allows you to use the Software only to interface with the licensor's other software components, such as Netdata Agents and Netdata Cloud. Any use with replacements for these components is not permitted.
    The question is, does a Netdata Agent that has only had a few lines of code modified still qualify as a Netdata Agent? Personally, I believe it does. This is what open-source software is all about.

Regardless, I've been using Netdata on my HomeLab for over seven years now. Its diagnostic capabilities and detailed metrics help me quickly resolve complex issues. I really like it.

Though recent changes, including the tight coupling with Netdata Cloud and the removal of the open-source v1 dashboard, have left me somewhat disappointed. We hope Netdata will become more user-friendly for individual users in terms of its product and design, rather than rushing to promote Netdata Cloud and expensive subscription plans.

You must be logged in to vote
2 replies
@fuad00
Comment options

nice one! people certainly need a docker image of that!

@lyc8503
Comment options

nice one! people certainly need a docker image of that!

I found some metrics missing when running in docker (even after mounting all required files), so I install Netdata directly on host.

If you'd like to have a docker image, you can pull the Netdata repo, make the modification above and build it locally. It should be much easier to build locally with Docker. Dockerfile is located atpackaging/docker/Dockerfile.

Comment options

I'm happy I didn't install locally and just ran it as a docker container for testing.
Now I can just 'docker compose down' and go find a different solution.

Thanks for the reports and confirm it's not really possible.

You must be logged in to vote
0 replies
Comment options

Good find,@lyc8503! It looks like a simpler change can instead be made tosrc/web/api/http_auth.h

diff --git a/src/web/api/http_auth.h b/src/web/api/http_auth.hindex 0b01fdb1e..6c6f67802 100644--- a/src/web/api/http_auth.h+++ b/src/web/api/http_auth.h@@ -15,7 +15,7 @@ time_t bearer_create_token(nd_uuid_t *uuid, HTTP_USER_ROLE user_role, HTTP_ACCES bool web_client_bearer_token_auth(struct web_client *w, const char *v);  static inline bool http_access_user_has_enough_access_level_for_endpoint(HTTP_ACCESS user, HTTP_ACCESS endpoint) {-    return ((user & endpoint) == endpoint);+    return true; }

This also unlocks the ability to mange collector configs from the UI as well.

You must be logged in to vote
0 replies
Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment
Category
Q&A
Labels
None yet
13 participants
@squeaktoy@ribtoks@gurka@budius@bits-craft@The1hauntedX@ilyam8@fuad00@lyc8503@Otmanraad@Myzel394@Ou7law007@MNLierman

[8]ページ先頭

©2009-2025 Movatter.jp