From 17c93e2be4ad7b3af0cd6878bdd5d8a4a3e6da99 Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Thu, 28 Nov 2019 05:53:29 +0100 Subject: Merging upstream version 1.19.0. Signed-off-by: Daniel Baumann --- registry/README.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) (limited to 'registry/README.md') diff --git a/registry/README.md b/registry/README.md index f852809be..205937ba4 100644 --- a/registry/README.md +++ b/registry/README.md @@ -122,6 +122,23 @@ Netdata v1.9+ support limiting access to the registry from given IPs, like this: Keep in mind that connections to Netdata API ports are filtered by `[web].allow connections from`. So, IPs allowed by `[registry].allow from` should also be allowed by `[web].allow connection from`. +The patterns can be matches over IP addresses or FQDN of the host. +In order to check the FQDN of the connection without opening the Netdata agent to DNS-spoofing, a reverse-dns record +must be setup for the connecting host. At connection time the reverse-dns of the peer IP address is resolved, and +a forward DNS resolution is made to validate the IP address against the name-pattern. + +Please note that this process can be expensive on a machine that is serving many connections. The behaviour of +the pattern matching can be controlled with the following setting: +``` +[registry] + allow by dns = heuristic +``` + +The settings are: +* `yes` allows the pattern to match DNS names. +* `no` disables DNS matching for the patterns (they only match IP addresses). +* `heuristic` will estimate if the patterns should match FQDNs by the presence or absence of `:`s or alpha-characters. + ### Where is the registry database stored? `/var/lib/netdata/registry/*.db` -- cgit v1.2.3