proxy_url: can contain secrets

[karlhungus]

Not sure if this is a bug or a feature request.

What did you do?

We use a proxy in our config of the form proxy_url: "http://proxy_user:proxy_password@...", because this isn't considered a Secret, these show up in our Status pages in alertmanager. and config pages on Prometheus web ui. Forcing us to block these pages

What did you expect to see?

I'd hoped we could mask these out, or mark the proxy as Secret

What did you see instead? Under which circumstances?

I saw the password.

Environment

• System information:

/ # uname -srm
Linux 4.4.98-1.el7.elrepo.x86_64 x86_64

• Alertmanager version:

/ # alertmanager --version
alertmanager, version 0.15.0-rc.0 (branch: HEAD, revision: 68122e7005958df611baec01b316355a6f408bae)
  build user:       root@46262c45c129
  build date:       20180228-11:57:18
  go version:       go1.10

I'd be happy to help with this, although I'm not 100% sure of the best approach - maybe SecretURL - or maybe the responsibility should be in the respective UI's to mask the possibly secret part of any url out.

[brian-brazil]

As documented the proxy_url is not a Secret so you shouldn't put secrets in there as they won't be protected. I'd suggest using basic auth which will hide it.

[karlhungus]

I interpreted basic auth as applying to the server being proxied - which I think it is - is it possible to configure basic auth for the proxy_url from the code it doesn't look like it: https://github.com/prometheus/common/blob/master/config/http_config.go#L74

I tried this in case I'd miss interpreted - and basic auth didn't work. Just to be clear - these are credentials to access the proxy - not the service being proxied.

[brian-brazil]

It all ends up as a header in the http request.

[karlhungus]

Yeah, i think it'd need a different header though, something like:

    //adding proxy authentication
    auth := "user:password"
    basicAuth := "Basic " + base64.StdEncoding.EncodeToString([]byte(auth))
    request.Header.Add("Proxy-Authorization", basicAuth)

I admit there's a healthy chance this is my lack of understanding, but this

      basic_auth:
        username: proxy_user
        password: proxy_password 
      proxy_url: http://proxyout.service

does not work, and the proxy properly gets grumpy:

level=info ts=2018-04-05T17:36:45.750134568Z caller=kubernetes.go:191 component="discovery manager scrape" discovery=k8s msg="Using pod service account via in-cluster config"
level=info ts=2018-04-05T17:36:45.752325142Z caller=main.go:491 msg="Server is ready to receive web requests."
level=error ts=2018-04-05T17:36:50.782935711Z caller=notifier.go:473 component=notifier alertmanager=http://proxyout.service/api/v1/alerts count=0 msg="Error sending alert" err="bad response status 407 Proxy Authentication Required"

[alindeman]

Yeah, i think it'd need a different header though

Right, the header that needs to be set for authenticating to a proxy is Proxy-Authorization, rather than Authorization. Is there a way to set the Proxy-Authorization header (as a Secret value) with Prometheus?

[brian-brazil]

There's presently no way to do so.

[karlhungus]

Would you be open to pr's to add something like:

proxy_url: <url>
  proxy_password: <secret>
  proxy_username: <text>

or maybe:

proxy_url: <url>
basic_proxy_auth:
  proxy_password: <secret>
  proxy_username: <text>

[brian-brazil]

I think first we'd need to understand what sort of authentication is common for HTTP proxies. Is it just basic auth, or do we need bearer token too? Might we need SSL client auth, and how would all that interact with what we already have?

[karlhungus]

It seems like at least squid can do a whole bunch: https://wiki.squid-cache.org/Features/Authentication.

…

On Fri, Apr 6, 2018 at 11:31 AM, Brian Brazil ***@***.***> wrote: I think first we'd need to understand what sort of authentication is common for HTTP proxies. Is it just basic auth, or do we need bearer token too? Might we need SSL client auth, and how would all that interact with what we already have? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#128 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAD7B0RvKzCxcO-jY1oBy0pVIKKWRpfEks5tl4pugaJpZM4TIl8M> .

[brian-brazil]

Go itself only does basic, and I'd rather not start supporting more than we do already.

[karlhungus]

My interpretation is that you would have a hard time adding a pr to take basic auth on the proxy, I'll close this -- if I'm mistaken and you'd take a PR that did basic proxy auth like:

proxy_url: <url>
  basic_proxy_auth:
    username: <string>
    password: <secret>

Feel free to reopen, and i'll PR something up.

[kinhak]

I am also facing same issue. basic_auth credentilas not working with proxy_url. Getting - context deadline exceeded error. If I specify username:password@proxy, it works but password can be seen by everybody from webpage.
Any solutions please.

http_config:
proxy_url: 'XXXX'
basic_auth:
username: xxx
password: xxx

[roidelapluie]

Fixed in Prometheus 2.30.1