Page MenuHomeVyOS Platform
Create Task
Maniphest T9569

telegraf: InfluxDB v2 output hard-codes insecure_skip_verify = true
In progress, HighPublicBUG
Actions

Description

The telegraf InfluxDB v2 output unconditionally disables TLS certificate verification, and the token is exposed locally.

Location
data/templates/telegraf/telegraf.j2:44

data/templates/telegraf/override.conf.j2:12

interface-definitions/service_monitoring_telegraf.xml.in

Problem
TLS verification unconditionally disabled with no CLI option; token also exposed in a 0644 systemd drop-in and via systemctl show -p Environment.

Impact
Token capture by an on-path attacker; token readable locally.

Suggested fix
Verify by default; add toggle and CA option; pass token via a 0600 EnvironmentFile.

Details

Version
rolling
Is it a breaking change?
Perfectly compatible
Issue type
Bug (incorrect behavior)

Event Timeline

natali-rs1985 created this task.Wed, Nov 4, 12:05 PM
natali-rs1985 changed the task status from Open to In progress.
natali-rs1985 claimed this task.
natali-rs1985 triaged this task as High priority.
pasik subscribed.Wed, Nov 4, 12:14 PM