jcoffey-dev
4b5dae5879
This is a large squashed commit covering two batches of prior uncommitted work plus a full security-audit remediation pass, kept together because go.mod/go.sum and several shared files (main.go, handler.go) were touched by both and splitting risked non-building intermediate commits. Features (built earlier, previously uncommitted): - Local username/password login for single-tenant deployments with no SSO configured (api/localauth, alerting/internal/sessioncheck, sentryctl users, web/src/routes/login, metadata migrations 0040/0041). - Remotely-editable additional log file paths for agents, on top of their existing primary source (api/agents, agent/sentry-agent extra-file-path diffing, web agent config UI). - IPv4/IPv6 addresses reported alongside other host system metrics. Security audit remediation (this pass, all live-verified in production): - Critical: block ClickHouse SSRF table functions (url/remote/file/s3/...) in the raw-SQL query escape hatch. - High: deny sensitive paths and require Admin to add agent extra_file_paths (Editor could previously point an agent at /etc/shadow or an SSH key); alerting webhook targets now validate against internal/metadata/loopback addresses, both at creation and send time; alerting's session middleware now enforces an Editor+ floor on mutating requests instead of "any authenticated session"; bumped goxmldsig to close a SAML signature-verification bypass (GO-2026-4753). - Medium: per-IP login rate limiting; security response headers (HSTS/CSP/nosniff/X-Frame-Options/Referrer-Policy/Permissions-Policy) on web/nginx.conf; a DevCredentialWarnings check in every Go service's config loader, logging loudly at startup if a deployment is still on docker-compose.yml's literal dev-only credentials; dependency bumps (golang.org/x/text, grpc, x/net, quick-xml, h2) across every affected Go module and both Rust crates, including a previously-uncovered x/net vulnerability in deploy/operator; a new security-scan.yml CI workflow running cargo-deny/govulncheck/npm-audit, mirroring the existing license-compliance.yml matrix shape. - Low: removed sentryctl's plaintext --password flag (shell history/`ps` exposure) in favor of stdin and a --password-stdin flag for reset-password's optional specific-password path; a dummy bcrypt comparison closes a login response-time username-enumeration side-channel.
72 lines
2.6 KiB
TOML
72 lines
2.6 KiB
TOML
# Example sentry-agent config. Copy to the platform's conventional path
|
|
# (/etc/sentry-agent/agent.toml on Linux, C:\ProgramData\SentryAgent\agent.toml
|
|
# on Windows), or pass --config /path/to/this/file.
|
|
#
|
|
# Every field has a built-in default (see src/config.rs), so this file only
|
|
# needs to contain what you're overriding. An agent with NO config file at
|
|
# all still runs: on Linux it defaults to journald, service = "default",
|
|
# and expects mTLS material at /etc/sentry-agent/{ca,client,client-key}.pem
|
|
# (Windows equivalents under C:\ProgramData\SentryAgent\).
|
|
|
|
[agent]
|
|
# host = "explicit-hostname-override" # defaults to /etc/hostname (Linux) or %COMPUTERNAME% (Windows)
|
|
service = "my-service"
|
|
|
|
[source]
|
|
kind = "journald"
|
|
# unit = "nginx.service" # omit to tail the whole journal
|
|
|
|
# To tail a file instead (works on both Linux and Windows):
|
|
# [source]
|
|
# kind = "file"
|
|
# path = "/var/log/nginx/access.log"
|
|
# from_beginning = false
|
|
|
|
# Windows Event Log (requires the agent to be built with the
|
|
# `windows-eventlog` feature — see /agent/README.md):
|
|
# [source]
|
|
# kind = "eventlog"
|
|
# channels = ["Application", "System", "Security"] # this is the default if omitted
|
|
|
|
# ETW (requires the `etw` feature, and usually elevated privileges — read
|
|
# /agent/README.md's privilege section before enabling this):
|
|
# [source]
|
|
# kind = "etw"
|
|
# providers = ["{22FB2CD6-0E7B-422B-A0C7-2FAD1FD0E716}"] # GUIDs, not friendly names
|
|
|
|
[batch]
|
|
max_size = 500
|
|
flush_interval_ms = 2000
|
|
|
|
[heartbeat]
|
|
# How often this agent proves it's still alive to the platform, sent as
|
|
# its own record independent of whatever real log traffic is flowing --
|
|
# pair with an "absence" alert rule on the sentry.heartbeat attribute to
|
|
# get paged when a host goes quiet. Accepts a plain number + unit: s
|
|
# (seconds), m (minutes), or h (hours) -- same vocabulary as
|
|
# earliest=/latest= in the query language. See
|
|
# /docs/agent-heartbeat-monitoring.md.
|
|
enabled = true
|
|
interval = "60s"
|
|
# interval = "5m"
|
|
# interval = "1h"
|
|
|
|
[metrics]
|
|
# Host CPU/memory/disk usage, sent as its own periodic record the same
|
|
# way heartbeat is (see web/'s "Hosts" nav section). Off by default --
|
|
# unlike heartbeat, this is a deliberate per-host decision: if several
|
|
# sentry-agent processes run on the same physical host (e.g. one per log
|
|
# source), enable this on only ONE of them, or the same host will report
|
|
# multiple conflicting metric series. Linux-only for now. Root disk ("/")
|
|
# only -- not configurable in this release.
|
|
enabled = false
|
|
interval = "60s"
|
|
|
|
[ingest]
|
|
endpoint = "https://ingest.internal:4317"
|
|
|
|
[tls]
|
|
ca_cert = "/etc/sentry-agent/ca.pem"
|
|
client_cert = "/etc/sentry-agent/client.pem"
|
|
client_key = "/etc/sentry-agent/client-key.pem"
|