From c423a15ec8c3fba2033421ea4acbe2158fc177b8 Mon Sep 17 00:00:00 2001 From: achatterjee-grafana <70489351+achatterjee-grafana@users.noreply.github.com> Date: Thu, 15 Apr 2021 14:33:00 -0400 Subject: [PATCH] Backport 33034 (#33038) * Fix for doc issue https://github.com/grafana/grafana/issues/32890 (#33034) * Added new section "Implications of enabling `Anonymous` access to dashboards". * Linked from Anonymous authentication section in "Grafana Auth". * Update docs/sources/administration/security.md Co-authored-by: Diana Payton <52059945+oddlittlebird@users.noreply.github.com> * Update docs/sources/auth/grafana.md Co-authored-by: Diana Payton <52059945+oddlittlebird@users.noreply.github.com> * Fixed formatting issues. Co-authored-by: Diana Payton <52059945+oddlittlebird@users.noreply.github.com> * Fix for doc issue https://github.com/grafana/grafana/issues/32890 (#33034) * Added new section "Implications of enabling `Anonymous` access to dashboards". * Linked from Anonymous authentication section in "Grafana Auth". * Update docs/sources/administration/security.md Co-authored-by: Diana Payton <52059945+oddlittlebird@users.noreply.github.com> * Update docs/sources/auth/grafana.md Co-authored-by: Diana Payton <52059945+oddlittlebird@users.noreply.github.com> * Fixed formatting issues. Co-authored-by: Diana Payton <52059945+oddlittlebird@users.noreply.github.com> * Fix for doc issue https://github.com/grafana/grafana/issues/32890 (#33034) * Added new section "Implications of enabling `Anonymous` access to dashboards". * Linked from Anonymous authentication section in "Grafana Auth". * Update docs/sources/administration/security.md Co-authored-by: Diana Payton <52059945+oddlittlebird@users.noreply.github.com> * Update docs/sources/auth/grafana.md Co-authored-by: Diana Payton <52059945+oddlittlebird@users.noreply.github.com> * Fixed formatting issues. Co-authored-by: Diana Payton <52059945+oddlittlebird@users.noreply.github.com> * Fix format issue. Co-authored-by: Diana Payton <52059945+oddlittlebird@users.noreply.github.com> --- docs/sources/administration/security.md | 8 ++++++++ docs/sources/auth/grafana.md | 2 +- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/docs/sources/administration/security.md b/docs/sources/administration/security.md index 22304963f8c..0cc5cb761f1 100644 --- a/docs/sources/administration/security.md +++ b/docs/sources/administration/security.md @@ -36,3 +36,11 @@ To address this vulnerability, you can restrict data source query access in the - Create multiple data sources with some restrictions added in data source configuration that restrict access (like database name or credentials). Then use the [Data Source Permissions]({{< relref "../permissions/datasource_permissions.md" >}}) Enterprise feature to restrict user access to the data source in Grafana. - Create a separate Grafana organization, and in that organization, create a separate data source. Make sure the data source has some option/user/credentials setting that limits access to a subset of the data. Not all data sources have an option to limit access. + +## Implications of enabling `Anonymous` access to dashboards + +When you enable Anonymous access to a dashboard, it is publicly available. This section lists the security implications of enabling Anonymous access. + +- Anyone with the URL can access the dashboard. +- Anyone can make view calls to the API and list all folders, dashboards, and data sources. +- Anyone can make arbitrary queries to any data source that the Grafana instance is configured with. diff --git a/docs/sources/auth/grafana.md b/docs/sources/auth/grafana.md index b19ae0d72f3..d15f41d4de9 100644 --- a/docs/sources/auth/grafana.md +++ b/docs/sources/auth/grafana.md @@ -52,7 +52,7 @@ api_key_max_seconds_to_live = -1 ### Anonymous authentication -You can make Grafana accessible without any login required by enabling anonymous access in the configuration file. +You can make Grafana accessible without any login required by enabling anonymous access in the configuration file. For more information, refer to [Implications of allowing Anonymous access to dashboards]({{< relref "../administration/security.md" >}}). Example: