Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Log the public source IP of connected agents #4146

Open
cmacknz opened this issue Nov 22, 2024 · 0 comments
Open

Log the public source IP of connected agents #4146

cmacknz opened this issue Nov 22, 2024 · 0 comments

Comments

@cmacknz
Copy link
Member

cmacknz commented Nov 22, 2024

Users sometimes want this for audit logging. Internally in Elastic Cloud we rely on our proxy logs to obtain this information. Investigate if we can log this information directly from Fleet Server in Elastic Cloud, and outside of it.

Golang's http.Request allows us to get the source IP of the incoming request, but this is not necessarily the public or edge facing IP of the machine the agent is running on if the presence of proxies or load balancers

        // RemoteAddr allows HTTP servers and other software to record
	// the network address that sent the request, usually for
	// logging. This field is not filled in by ReadRequest and
	// has no defined format. The HTTP server in this package
	// sets RemoteAddr to an "IP:port" address before invoking a
	// handler.
	// This field is ignored by the HTTP client.
	RemoteAddr [string](https://pkg.go.dev/builtin#string)

To get the source IP of the agent machine we could look at the X-Forwarded-For or a similar header, but it is only safe for us to use headers like this in Elastic Cloud where Elastic is in control of the proxy and the values set in this or other relevant headers. Headers can be set by any client in the request chain, regardless of if that client is trusted or malicious.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant