Slight grafana file permissions improvement

2020-03-11 Thread Kevin Chadwick
Thankyou for updating the Grafana port. The /etc/grafana/custom.ini contains a default key and can contain passwords. These are public knowledge but may be changed and better to be secure by default. https://github.com/grafana/grafana/pull/2306 https://github.com/grafana/grafana/issues/2126 Co

Re: Slight grafana file permissions improvement

2020-03-12 Thread Landry Breuil
On Wed, Mar 11, 2020 at 02:46:38PM +, Kevin Chadwick wrote: > Thankyou for updating the Grafana port. > > The /etc/grafana/custom.ini contains a default key and can contain passwords. > > These are public knowledge but may be changed and better to be secure by > default. > > https://github.

Re: Slight grafana file permissions improvement

2020-03-12 Thread Eric Elena
On Thu, 12 Mar 2020 19:27:17 +0100 Landry Breuil wrote: > On Wed, Mar 11, 2020 at 02:46:38PM +, Kevin Chadwick wrote: > > Thankyou for updating the Grafana port. > > > > The /etc/grafana/custom.ini contains a default key and can contain > > passwords. > > > > These are public knowledge but m

Re: Slight grafana file permissions improvement

2020-03-13 Thread Kevin Chadwick
On 2020-03-13 00:07, Eric Elena wrote: > Changing /etc/grafana to root:_grafana 750 looks reasonable, I'll try to send > a diff soon. v6.7.0-beta1 was released a few hours ago, maybe the fix can go > with v6.7.0 as we Grafana only runs as one user, so should work well. Ideally the config would s

Re: Slight grafana file permissions improvement

2020-03-13 Thread Kevin Chadwick
On 2020-03-13 14:10, Kevin Chadwick wrote: > Grafana only runs as one user, so should work well. Ideally the config would > still be world readable and the secrets separated out. I should say that by ideally I just mean in case the config and anything else is useful to multiple users, rather than

Re: Slight grafana file permissions improvement

2020-04-14 Thread Martin Reindl
On Fri, Mar 13, 2020 at 02:18:34PM +, Kevin Chadwick wrote: > On 2020-03-13 14:10, Kevin Chadwick wrote: > > Grafana only runs as one user, so should work well. Ideally the config would > > still be world readable and the secrets separated out. > > I should say that by ideally I just mean in c

Re: Slight grafana file permissions improvement

2020-04-14 Thread Stuart Henderson
On 2020/04/14 14:59, Martin Reindl wrote: > On Fri, Mar 13, 2020 at 02:18:34PM +, Kevin Chadwick wrote: > > On 2020-03-13 14:10, Kevin Chadwick wrote: > > > Grafana only runs as one user, so should work well. Ideally the config > > > would > > > still be world readable and the secrets separate

Re: Slight grafana file permissions improvement

2020-04-14 Thread Kevin Chadwick
On 2020-04-14 14:15, Stuart Henderson wrote: > my 2p: setting the directory 750 is a pain for tab completion, > so if this is changed I think it would be better to set permissions on > the sensitive files only. AFAIK /etc/grafana/config.ini is the only sensitive config file. Though I have seen var

Re: Slight grafana file permissions improvement

2020-04-14 Thread Stuart Henderson
On 2020/04/14 14:28, Kevin Chadwick wrote: > On 2020-04-14 14:15, Stuart Henderson wrote: > > my 2p: setting the directory 750 is a pain for tab completion, > > so if this is changed I think it would be better to set permissions on > > the sensitive files only. > > AFAIK /etc/grafana/config.ini is

Re: Slight grafana file permissions improvement

2020-04-14 Thread Eric Elena
On Tue, 14 Apr 2020 14:38:37 +0100 Stuart Henderson wrote: > On 2020/04/14 14:28, Kevin Chadwick wrote: > > On 2020-04-14 14:15, Stuart Henderson wrote: > > > my 2p: setting the directory 750 is a pain for tab completion, > > > so if this is changed I think it would be better to set permissions on

Re: Slight grafana file permissions improvement

2020-04-14 Thread Stuart Henderson
On 2020/04/14 15:59, Eric Elena wrote: > On Tue, 14 Apr 2020 14:38:37 +0100 Stuart Henderson wrote: > > On 2020/04/14 14:28, Kevin Chadwick wrote: > > > On 2020-04-14 14:15, Stuart Henderson wrote: > > > > my 2p: setting the directory 750 is a pain for tab completion, > > > > so if this is changed

Re: Slight grafana file permissions improvement

2020-04-14 Thread Martin Reindl
Am 14.04.20 um 16:21 schrieb Stuart Henderson: > On 2020/04/14 15:59, Eric Elena wrote: >> On Tue, 14 Apr 2020 14:38:37 +0100 Stuart Henderson wrote: >>> On 2020/04/14 14:28, Kevin Chadwick wrote: On 2020-04-14 14:15, Stuart Henderson wrote: > my 2p: setting the directory 750 is a pain for

Re: Slight grafana file permissions improvement

2020-04-14 Thread Martin Reindl
On Tue, Apr 14, 2020 at 04:51:38PM +0200, Martin Reindl wrote: > Am 14.04.20 um 16:21 schrieb Stuart Henderson: > > On 2020/04/14 15:59, Eric Elena wrote: > >> On Tue, 14 Apr 2020 14:38:37 +0100 Stuart Henderson wrote: > >>> On 2020/04/14 14:28, Kevin Chadwick wrote: > On 2020-04-14 14:15, Stu

Re: Slight grafana file permissions improvement

2020-04-14 Thread Rafael Sadowski
On Wed Apr 15, 2020 at 08:11:09AM +0200, Martin Reindl wrote: > On Tue, Apr 14, 2020 at 04:51:38PM +0200, Martin Reindl wrote: > > Am 14.04.20 um 16:21 schrieb Stuart Henderson: > > > On 2020/04/14 15:59, Eric Elena wrote: > > >> On Tue, 14 Apr 2020 14:38:37 +0100 Stuart Henderson wrote: > > >>> On

Re: Slight grafana file permissions improvement

2020-04-14 Thread Landry Breuil
On Wed, Apr 15, 2020 at 08:11:09AM +0200, Martin Reindl wrote: > On Tue, Apr 14, 2020 at 04:51:38PM +0200, Martin Reindl wrote: > > Am 14.04.20 um 16:21 schrieb Stuart Henderson: > > > On 2020/04/14 15:59, Eric Elena wrote: > > >> On Tue, 14 Apr 2020 14:38:37 +0100 Stuart Henderson wrote: > > >>> O

Re: Slight grafana file permissions improvement

2020-04-15 Thread Eric Elena
On Wed, 15 Apr 2020 08:51:35 +0200 Landry Breuil wrote: > On Wed, Apr 15, 2020 at 08:11:09AM +0200, Martin Reindl wrote: > > On Tue, Apr 14, 2020 at 04:51:38PM +0200, Martin Reindl wrote: > > > Am 14.04.20 um 16:21 schrieb Stuart Henderson: > > > > On 2020/04/14 15:59, Eric Elena wrote: > > > >> On

Re: Slight grafana file permissions improvement

2020-04-15 Thread Rafael Sadowski
On Wed Apr 15, 2020 at 04:18:56PM +0200, Eric Elena wrote: > On Wed, 15 Apr 2020 08:51:35 +0200 Landry Breuil wrote: > > On Wed, Apr 15, 2020 at 08:11:09AM +0200, Martin Reindl wrote: > > > On Tue, Apr 14, 2020 at 04:51:38PM +0200, Martin Reindl wrote: > > > > Am 14.04.20 um 16:21 schrieb Stuart He

Re: Slight grafana file permissions improvement

2020-04-22 Thread Martin Reindl
On Wed, Apr 15, 2020 at 05:44:24PM +0200, Rafael Sadowski wrote: > On Wed Apr 15, 2020 at 04:18:56PM +0200, Eric Elena wrote: > > On Wed, 15 Apr 2020 08:51:35 +0200 Landry Breuil wrote: > > > On Wed, Apr 15, 2020 at 08:11:09AM +0200, Martin Reindl wrote: > > > > On Tue, Apr 14, 2020 at 04:51:38PM +

Re: Slight grafana file permissions improvement

2020-04-22 Thread Landry Breuil
On Wed, Apr 22, 2020 at 01:34:21PM +0200, Martin Reindl wrote: > On Wed, Apr 15, 2020 at 05:44:24PM +0200, Rafael Sadowski wrote: > > On Wed Apr 15, 2020 at 04:18:56PM +0200, Eric Elena wrote: > > > On Wed, 15 Apr 2020 08:51:35 +0200 Landry Breuil wrote: > > > > This version works for me. OK rsado

Re: Slight grafana file permissions improvement

2020-04-23 Thread Eric Elena
On Wed, 22 Apr 2020 14:34:51 +0200 Landry Breuil wrote: > On Wed, Apr 22, 2020 at 01:34:21PM +0200, Martin Reindl wrote: > > On Wed, Apr 15, 2020 at 05:44:24PM +0200, Rafael Sadowski wrote: > > > > > > This version works for me. OK rsadowski@ > > > > Apologies for the delayed followup. Per Stuart