From 3fab4d6f8caa15790b4f8a6103a0998a56ce348c Mon Sep 17 00:00:00 2001 From: Marcus Efraimsson Date: Wed, 13 Feb 2019 19:52:27 +0100 Subject: [PATCH 01/11] docs: fix typo --- docs/sources/auth/overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/sources/auth/overview.md b/docs/sources/auth/overview.md index 1d0b0d89b3f..fc22d6b2d7f 100644 --- a/docs/sources/auth/overview.md +++ b/docs/sources/auth/overview.md @@ -38,7 +38,7 @@ provider (listed above). There is also options for allowing self sign up. ### Login and short-lived tokens -> The followung applies when using Grafana's built in user authentication, LDAP (without Auth proxy) or OAuth integration. +> The following applies when using Grafana's built in user authentication, LDAP (without Auth proxy) or OAuth integration. Grafana are using short-lived tokens as a mechanism for verifying authenticated users. These short-lived tokens are rotated each `token_rotation_interval_minutes` for an active authenticated user. From 592f57d0ba5487f8c6621a98cae5446f435ded67 Mon Sep 17 00:00:00 2001 From: Marcus Efraimsson Date: Wed, 13 Feb 2019 19:53:25 +0100 Subject: [PATCH 02/11] docs: add note regarding auth proxy and user session requirement --- docs/sources/tutorials/ha_setup.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/sources/tutorials/ha_setup.md b/docs/sources/tutorials/ha_setup.md index f141392e223..3464f124458 100644 --- a/docs/sources/tutorials/ha_setup.md +++ b/docs/sources/tutorials/ha_setup.md @@ -26,6 +26,8 @@ Grafana will now persist all long term data in the database. How to configure th ## User sessions +> Beginning with Grafana v6.0 and above the following only applies when using [Auth Proxy Authentication](/auth/auth-proxy/). + The second thing to consider is how to deal with user sessions and how to configure your load balancer in front of Grafana. Grafana supports two ways of storing session data: locally on disk or in a database/cache-server. If you want to store sessions on disk you can use `sticky sessions` in your load balancer. If you prefer to store session data in a database/cache-server From 1bd9573f8ec9a40dd87f79f5fa103bff10fa6593 Mon Sep 17 00:00:00 2001 From: Marcus Efraimsson Date: Wed, 13 Feb 2019 19:53:55 +0100 Subject: [PATCH 03/11] docs: add upgrade notes for v6.0 --- docs/sources/installation/upgrading.md | 29 ++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/docs/sources/installation/upgrading.md b/docs/sources/installation/upgrading.md index a476a38c3c5..18c6cb649b1 100644 --- a/docs/sources/installation/upgrading.md +++ b/docs/sources/installation/upgrading.md @@ -117,3 +117,32 @@ One of the database migrations included in this release will update all annotati We've got one report where using systemd, PostgreSQL and a large amount of annotations (table size 1645mb) took 8-20 minutes for the database migration to complete. However, the grafana-server process was killed after 90 seconds by systemd. Any database migration queries in progress when systemd kills the grafana-server process continues to execute in database until finished. If you're using systemd and have a large amount of annotations consider temporary adjusting the systemd `TimeoutStartSec` setting to something high like `30m` before upgrading. + +## Upgrading to v6.0 + +If you have text panels with script tags they will no longer work due to a new setting that per default disallow unsanitzied HTML. +Read more [here](/installation/configuration/#disable-sanitize-html) about this new setting. + +### Authentication and security + +If your using Grafana's builtin, LDAP (without Auth Proxy) or OAuth authentication all users will be required to login upon the next visit after the upgrade. + +If you have `cookie_secure` set to `true` in the `session` section you probably want to change the `cookie_secure` to `true` in the `security` section as well. Ending up with a configuration like this: + +```ini +[session] +cookie_secure = true + +[security] +cookie_secure = true +``` + +The `login_remember_days`, `cookie_username` and `cookie_remember_name` settings in the `security` section are no longer being used so they're safe to remove. + +If you have `login_remember_days` configured to 0 (zero) you should change your configuration to this to accomplish similar behavior, i.e. a logged in user will maximum be logged in for 1 day until being forced to login again: + +```ini +[auth] +login_maximum_inactive_lifetime_days = 1 +login_maximum_lifetime_days = 1 +``` From de2f3db4130c4afc6b57cdb614151e21060daeed Mon Sep 17 00:00:00 2001 From: Marcus Efraimsson Date: Wed, 13 Feb 2019 19:54:45 +0100 Subject: [PATCH 04/11] docs: improve removal of session storage for what's new in v6.0 --- docs/sources/guides/whats-new-in-v6-0.md | 32 +++++++++++++++++------- 1 file changed, 23 insertions(+), 9 deletions(-) diff --git a/docs/sources/guides/whats-new-in-v6-0.md b/docs/sources/guides/whats-new-in-v6-0.md index 61eec0ac390..2cf26723062 100644 --- a/docs/sources/guides/whats-new-in-v6-0.md +++ b/docs/sources/guides/whats-new-in-v6-0.md @@ -27,6 +27,7 @@ The main highlights are: - [Azure Monitor]({{< relref "#azure-monitor-datasource" >}}) plugin is ported from being an external plugin to being a core datasource - [React Plugin]({{< relref "#react-panels-query-editors" >}}) support enables an easier way to build plugins. - [Named Colors]({{< relref "#named-colors" >}}) in our new improved color picker. +- [Removal of user session storage]({{< relref "#easier-to-deploy-more-secure" >}}) makes Grafana easier to deploy & more secure. ## Explore @@ -113,30 +114,39 @@ will be shared closer to or just after release. {{< docs-imagebox img="/img/docs/v60/react_panels.png" max-width="600px" caption="React Panel" >}}
-### Google Stackdriver Datasource +## Google Stackdriver Datasource Built-in support for [Google Stackdriver](https://cloud.google.com/stackdriver/) is officially released in Grafana 6.0. Beta support was added in Grafana 5.3 and we have added lots of improvements since then. To get started read the guide: [Using Google Stackdriver in Grafana](/features/datasources/stackdriver/). -### Azure Monitor Datasource +## Azure Monitor Datasource One of the goals of the Grafana v6.0 release is to add support for the three major clouds. Amazon Cloudwatch has been a core datasource for years and Google Stackdriver is also now supported. We developed an external plugin for Azure Monitor last year and for this release the [plugin](https://grafana.com/plugins/grafana-azure-monitor-datasource) is being moved into Grafana to be one of the built-in datasources. For users of the external plugin, Grafana will automatically start using the built-in version. As a core datasource, the Azure Monitor datasource will get alerting support for the official 6.0 release. The Azure Monitor datasource integrates four Azure services with Grafana - Azure Monitor, Azure Log Analytics, Azure Application Insights and Azure Application Insights Analytics. -### Provisioning support for alert notifiers +## Provisioning support for alert notifiers Grafana now added support for provisioning alert notifiers from configuration files. Allowing operators to provision notifiers without using the UI or the API. A new field called `uid` has been introduced which is a string identifier that the administrator can set themselves. Same kind of identifier used for dashboards since v5.0. This feature makes it possible to use the same notifier configuration in multiple environments and refer to notifiers in dashboard json by a string identifier instead of the numeric id which depends on insert order and how many notifiers that exists in the instance. -### Auth and session token improvements +## Easier to deploy & more secure -The previous session storage implementation in Grafana was causing problems in larger HA setups due to too many write requests to the database. The remember me token also have several security issues which is why we decided to rewrite auth middleware in Grafana and remove the session storage since most operations using the session storage could be rewritten to use cookies or data already made available earlier in the request. -If you are using `Auth proxy` for authentication the session storage will still be used but our goal is to remove this ASAP as well. +Grafana 6.0 removes the need of configuring and setup of additional storage for [user sessions](/tutorials/ha_setup/#user-sessions). This should make it easier to deploy and operate Grafana in a +high availability setup and/or if you're using a stateless user session storage like Redis, Memcache, Postgres or MySQL. -This release will force all users to log in again since their previous token is not valid anymore. +Instead of user sessions a solution based on short-lived tokens that are rotated frequently have been implemented. This also replaces the old "remember me cookie" +solution, which allowed a user to be logged in between browser sessions, and which have been subject to several security holes throughout the years. +Read more about the short-lived token solution and how to configure it [here](/auth/overview/#login-and-short-lived-tokens). -### Named Colors +> Please note that due to these changes, all users will be required to login upon next visit after upgrade. + +Besides these changes there have also been security improvements regarding protection against Cross-Site Request Forgery (CSRF) and Cross-site Scripting (XSS) attacks. + +> If you're using [Auth Proxy Authentication](/auth/auth-proxy/) you still need to have user sessions setup and configured +but our goal is to remove this requirements in a near future. + +## Named Colors {{< docs-imagebox img="/img/docs/v60/named_colors.png" max-width="400px" class="docs-image--right" caption="Named Colors" >}} @@ -148,12 +158,16 @@ Named colors also enables Grafana to adapt colors to the current theme.
-### Other features +## Other features - The ElasticSearch datasource now supports [bucket script pipeline aggregations](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-pipeline-bucket-script-aggregation.html). This gives the ability to do per bucket computations like the difference or ratio between two metrics. - Support for Google Hangouts Chat alert notifications - New built in template variables for the current time range in `$__from` and `$__to` +## Upgrading + +See [upgrade notes](/installation/upgrading/#upgrading-to-v6-0). + ## Changelog Checkout the [CHANGELOG.md](https://github.com/grafana/grafana/blob/master/CHANGELOG.md) file for a complete list of new features, changes, and bug fixes. From 7f7cc85ef0b0319a12cb02aa541952414c14f154 Mon Sep 17 00:00:00 2001 From: bergquist Date: Thu, 14 Feb 2019 13:24:41 +0100 Subject: [PATCH 05/11] docs: adds note about new login cookie name --- docs/sources/installation/upgrading.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/sources/installation/upgrading.md b/docs/sources/installation/upgrading.md index 18c6cb649b1..d230efb1888 100644 --- a/docs/sources/installation/upgrading.md +++ b/docs/sources/installation/upgrading.md @@ -146,3 +146,5 @@ If you have `login_remember_days` configured to 0 (zero) you should change your login_maximum_inactive_lifetime_days = 1 login_maximum_lifetime_days = 1 ``` + +The default cookie name for storing the auth token is `grafana_sess`. you can configure this with `login_cookie_name` in `[auth]` settings. \ No newline at end of file From 933d4729db6062b99ad614316aa63312e8e6f6a1 Mon Sep 17 00:00:00 2001 From: bergquist Date: Thu, 14 Feb 2019 14:06:50 +0100 Subject: [PATCH 06/11] docs: mention samesite setting --- docs/sources/guides/whats-new-in-v6-0.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/sources/guides/whats-new-in-v6-0.md b/docs/sources/guides/whats-new-in-v6-0.md index 2cf26723062..e411704f757 100644 --- a/docs/sources/guides/whats-new-in-v6-0.md +++ b/docs/sources/guides/whats-new-in-v6-0.md @@ -130,7 +130,7 @@ The Azure Monitor datasource integrates four Azure services with Grafana - Azure Grafana now added support for provisioning alert notifiers from configuration files. Allowing operators to provision notifiers without using the UI or the API. A new field called `uid` has been introduced which is a string identifier that the administrator can set themselves. Same kind of identifier used for dashboards since v5.0. This feature makes it possible to use the same notifier configuration in multiple environments and refer to notifiers in dashboard json by a string identifier instead of the numeric id which depends on insert order and how many notifiers that exists in the instance. -## Easier to deploy & more secure +## Easier to deploy & more secure authentication Grafana 6.0 removes the need of configuring and setup of additional storage for [user sessions](/tutorials/ha_setup/#user-sessions). This should make it easier to deploy and operate Grafana in a high availability setup and/or if you're using a stateless user session storage like Redis, Memcache, Postgres or MySQL. @@ -141,7 +141,7 @@ Read more about the short-lived token solution and how to configure it [here](/a > Please note that due to these changes, all users will be required to login upon next visit after upgrade. -Besides these changes there have also been security improvements regarding protection against Cross-Site Request Forgery (CSRF) and Cross-site Scripting (XSS) attacks. +Besides these changes we have also introduced [SameSite](https://www.owasp.org/index.php/SameSite) setting to protect against Cross-Site Request Forgery (CSRF) and Cross-site Scripting (XSS) attacks. This setting enables more control of when the browser include cookies in requests. Its set to `lax` by default but can be configured using `cookie_samesite` under `[security]` > If you're using [Auth Proxy Authentication](/auth/auth-proxy/) you still need to have user sessions setup and configured but our goal is to remove this requirements in a near future. From 94c1335f1101c5f177536c76c925ff6c13ffc775 Mon Sep 17 00:00:00 2001 From: bergquist Date: Thu, 14 Feb 2019 14:17:02 +0100 Subject: [PATCH 07/11] docs: move alerting above session --- docs/sources/tutorials/ha_setup.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/docs/sources/tutorials/ha_setup.md b/docs/sources/tutorials/ha_setup.md index 3464f124458..f20a9933126 100644 --- a/docs/sources/tutorials/ha_setup.md +++ b/docs/sources/tutorials/ha_setup.md @@ -15,7 +15,7 @@ Setting up Grafana for high availability is fairly simple. It comes down to two 2. Decide how to store session data.
- +
## Configure multiple servers to use the same database @@ -24,6 +24,10 @@ First, you need to do is to setup MySQL or Postgres on another server and config You can find the configuration for doing that in the [[database]]({{< relref "configuration.md" >}}#database) section in the grafana config. Grafana will now persist all long term data in the database. How to configure the database for high availability is out of scope for this guide. We recommend finding an expert on for the database you're using. +## Alerting + +Currently alerting supports a limited form of high availability. Since v4.2.0, alert notifications are deduped when running multiple servers. This means all alerts are executed on every server but alert notifications are only sent once per alert. Grafana does not support load distribution between servers. + ## User sessions > Beginning with Grafana v6.0 and above the following only applies when using [Auth Proxy Authentication](/auth/auth-proxy/). @@ -43,6 +47,4 @@ If you use MySQL/Postgres for session storage, you first need a table to store t For Grafana itself it doesn't really matter if you store the session data on disk or database/redis/memcache. But we recommend using a database/redis/memcache since it makes it easier manage the grafana servers. -## Alerting -Currently alerting supports a limited form of high availability. Since v4.2.0, alert notifications are deduped when running multiple servers. This means all alerts are executed on every server but alert notifications are only sent once per alert. Grafana does not support distributing the alert rule execution between servers. That might be added in the future but right now prefer to keep it simple. From 191f9c8407220f2702c1fb43d1b2134629bc8bef Mon Sep 17 00:00:00 2001 From: bergquist Date: Thu, 14 Feb 2019 19:42:39 +0100 Subject: [PATCH 08/11] whats new: rename security section --- docs/sources/guides/whats-new-in-v6-0.md | 8 +++++--- docs/sources/installation/upgrading.md | 2 +- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/docs/sources/guides/whats-new-in-v6-0.md b/docs/sources/guides/whats-new-in-v6-0.md index e411704f757..656e563a7f8 100644 --- a/docs/sources/guides/whats-new-in-v6-0.md +++ b/docs/sources/guides/whats-new-in-v6-0.md @@ -27,7 +27,7 @@ The main highlights are: - [Azure Monitor]({{< relref "#azure-monitor-datasource" >}}) plugin is ported from being an external plugin to being a core datasource - [React Plugin]({{< relref "#react-panels-query-editors" >}}) support enables an easier way to build plugins. - [Named Colors]({{< relref "#named-colors" >}}) in our new improved color picker. -- [Removal of user session storage]({{< relref "#easier-to-deploy-more-secure" >}}) makes Grafana easier to deploy & more secure. +- [Removal of user session storage]({{< relref "#easier-to-deploy-improved security" >}}) makes Grafana easier to deploy & improved security. ## Explore @@ -130,7 +130,7 @@ The Azure Monitor datasource integrates four Azure services with Grafana - Azure Grafana now added support for provisioning alert notifiers from configuration files. Allowing operators to provision notifiers without using the UI or the API. A new field called `uid` has been introduced which is a string identifier that the administrator can set themselves. Same kind of identifier used for dashboards since v5.0. This feature makes it possible to use the same notifier configuration in multiple environments and refer to notifiers in dashboard json by a string identifier instead of the numeric id which depends on insert order and how many notifiers that exists in the instance. -## Easier to deploy & more secure authentication +## Easier to deploy & improved security Grafana 6.0 removes the need of configuring and setup of additional storage for [user sessions](/tutorials/ha_setup/#user-sessions). This should make it easier to deploy and operate Grafana in a high availability setup and/or if you're using a stateless user session storage like Redis, Memcache, Postgres or MySQL. @@ -141,11 +141,13 @@ Read more about the short-lived token solution and how to configure it [here](/a > Please note that due to these changes, all users will be required to login upon next visit after upgrade. -Besides these changes we have also introduced [SameSite](https://www.owasp.org/index.php/SameSite) setting to protect against Cross-Site Request Forgery (CSRF) and Cross-site Scripting (XSS) attacks. This setting enables more control of when the browser include cookies in requests. Its set to `lax` by default but can be configured using `cookie_samesite` under `[security]` +Besides these changes we have also introduced [SameSite](https://www.owasp.org/index.php/SameSite) setting to protect against Cross-Site Request Forgery (CSRF). This setting enables more control of when the browser include cookies in requests. Its set to `lax` by default but can be configured using `cookie_samesite` under `[security]` > If you're using [Auth Proxy Authentication](/auth/auth-proxy/) you still need to have user sessions setup and configured but our goal is to remove this requirements in a near future. +We also disable script tags in text panels by defult to avoid Cross-site Scripting (XSS) attacks. + ## Named Colors {{< docs-imagebox img="/img/docs/v60/named_colors.png" max-width="400px" class="docs-image--right" caption="Named Colors" >}} diff --git a/docs/sources/installation/upgrading.md b/docs/sources/installation/upgrading.md index d230efb1888..e235f25b9e9 100644 --- a/docs/sources/installation/upgrading.md +++ b/docs/sources/installation/upgrading.md @@ -147,4 +147,4 @@ login_maximum_inactive_lifetime_days = 1 login_maximum_lifetime_days = 1 ``` -The default cookie name for storing the auth token is `grafana_sess`. you can configure this with `login_cookie_name` in `[auth]` settings. \ No newline at end of file +The default cookie name for storing the auth token is `grafana_session`. you can configure this with `login_cookie_name` in `[auth]` settings. \ No newline at end of file From af5a2468e88bffbe6fc7412c4a859b51af0feb82 Mon Sep 17 00:00:00 2001 From: bergquist Date: Thu, 14 Feb 2019 20:18:24 +0100 Subject: [PATCH 09/11] fix spelling error --- docs/sources/guides/whats-new-in-v6-0.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/sources/guides/whats-new-in-v6-0.md b/docs/sources/guides/whats-new-in-v6-0.md index 656e563a7f8..e789b6e71b2 100644 --- a/docs/sources/guides/whats-new-in-v6-0.md +++ b/docs/sources/guides/whats-new-in-v6-0.md @@ -146,7 +146,7 @@ Besides these changes we have also introduced [SameSite](https://www.owasp.org/i > If you're using [Auth Proxy Authentication](/auth/auth-proxy/) you still need to have user sessions setup and configured but our goal is to remove this requirements in a near future. -We also disable script tags in text panels by defult to avoid Cross-site Scripting (XSS) attacks. +We also disable script tags in text panels by default to avoid Cross-site Scripting (XSS) attacks. ## Named Colors From 88fbe3adcab52f47224584dba91324a6db342a4e Mon Sep 17 00:00:00 2001 From: Marcus Efraimsson Date: Fri, 15 Feb 2019 11:27:21 +0100 Subject: [PATCH 10/11] docs: fix header --- docs/sources/installation/configuration.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/sources/installation/configuration.md b/docs/sources/installation/configuration.md index d85e39146dc..2352bd15b89 100644 --- a/docs/sources/installation/configuration.md +++ b/docs/sources/installation/configuration.md @@ -594,7 +594,7 @@ Default setting for new alert rules. Defaults to categorize error and timeouts a Default setting for how Grafana handles nodata or null values in alerting. (alerting, no_data, keep_state, ok) -# concurrent_render_limit +### concurrent_render_limit > Available in 5.3 and above From ff87f6d303961f5c3f8a9304b7bfb6f57233e593 Mon Sep 17 00:00:00 2001 From: Marcus Efraimsson Date: Fri, 15 Feb 2019 11:31:29 +0100 Subject: [PATCH 11/11] docs: suggested changes --- docs/sources/guides/whats-new-in-v6-0.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/docs/sources/guides/whats-new-in-v6-0.md b/docs/sources/guides/whats-new-in-v6-0.md index e789b6e71b2..2ba7e86b385 100644 --- a/docs/sources/guides/whats-new-in-v6-0.md +++ b/docs/sources/guides/whats-new-in-v6-0.md @@ -27,7 +27,7 @@ The main highlights are: - [Azure Monitor]({{< relref "#azure-monitor-datasource" >}}) plugin is ported from being an external plugin to being a core datasource - [React Plugin]({{< relref "#react-panels-query-editors" >}}) support enables an easier way to build plugins. - [Named Colors]({{< relref "#named-colors" >}}) in our new improved color picker. -- [Removal of user session storage]({{< relref "#easier-to-deploy-improved security" >}}) makes Grafana easier to deploy & improved security. +- [Removal of user session storage]({{< relref "#easier-to-deploy-improved-security" >}}) makes Grafana easier to deploy & improves security. ## Explore @@ -141,13 +141,14 @@ Read more about the short-lived token solution and how to configure it [here](/a > Please note that due to these changes, all users will be required to login upon next visit after upgrade. -Besides these changes we have also introduced [SameSite](https://www.owasp.org/index.php/SameSite) setting to protect against Cross-Site Request Forgery (CSRF). This setting enables more control of when the browser include cookies in requests. Its set to `lax` by default but can be configured using `cookie_samesite` under `[security]` +Besides these changes we have also made security improvements regarding Cross-Site Request Forgery (CSRF) and Cross-site Scripting (XSS) vulnerabilities: + +* Cookies are per default using the [SameSite](/installation/configuration/#cookie-samesite) attribute to protect against CSRF attacks +* Script tags in text panels are per default [disabled](/installation/configuration/#disable-sanitize-html) to protect against XSS attacks > If you're using [Auth Proxy Authentication](/auth/auth-proxy/) you still need to have user sessions setup and configured but our goal is to remove this requirements in a near future. -We also disable script tags in text panels by default to avoid Cross-site Scripting (XSS) attacks. - ## Named Colors {{< docs-imagebox img="/img/docs/v60/named_colors.png" max-width="400px" class="docs-image--right" caption="Named Colors" >}}