User with limited rights dedicated only for monitoring

[Merhaut]

Hi,
I would like suggest to add user with limited rights (or user group) wich will be dedicated only for monitring. I want use XML with my external service but I am little afraid to use administrator account for it.
Thank you

[MorrisJobke]

Best here would be a random token that only allows this endpoint. Similar to what was requested in nextcloud/server#7474

[doobry-systemli]

That would be really nice to have and is a requirement for using the serverinfo output for proper monitoring.

In my eyes, using a full-featured Nextcloud user for accessing he serverinfo data from your monitoring software is not an option for security reasons.

[doobry-systemli]

Any news on that? Just a friendly nudge as I'd love to see this feature :)

[oddmean]

As @MorrisJobke said you could use your existing account,

"Create new app password" in Settings -> Security, then you just find the token in sessions list and disable filesystem access for it. Here is a screenshot.

[doobry-systemli]

Mh, I'm not convinced. In order to use the metrics from the XML, I need HTTPS access with the user credentials. According to my tests, /apps/serverinfo/api/v1/info is not accessible via HTTPS using app passwords.

Besides, it still seems a bit weird to use admin login credentials for requesting the monitoring metrics even when the permissions for these credentials are stripped down.

[oddmean]

@doobry-systemli looks like you're wrong: my zabbix polls https://${nextcloud_server_FQDN}/ocs/v2.php/apps/serverinfo/api/v1/info with an "app password" and I've disabled filesysetm access for this token. My administrative account (with TOTP authentication turned on) is used: API is accessed with an app token so 2FA is skipped.

[cguentherTUChemnitz]

I want to use this mechanism for the docker health checking system. This enables us the possibility of executing the health check command inside the docker container server instance itself running against localhost. So whitelist localhost connections would be really nice here.

@MorrisJobke What do you think about this proposal? Maybe you can look on what i want to achieve in nextcloud/docker#676

[MorrisJobke]

@MorrisJobke What do you think about this proposal? Maybe you can look on what i want to achieve in nextcloud/docker#676

See my comment over there.

[hypervtechnics]

So... This is the obligatory question: Any news on this?

[PVince81]

Another idea would be if there could be an occ command that outputs the monitoring data as json, this would then remove the need for providing any credentials