Replies: 9 comments 12 replies
-
|
Hi, @squeaktoy. Not all functions require Cloud connection, see Available Functions (
What is your Netdata version? Can you show There was a bug in a nightly version but it was fixed over a week ago. |
Beta Was this translation helpful? Give feedback.
-
|
After updating to 1..45.4, I still cannot use the |
Beta Was this translation helpful? Give feedback.
-
There it says:
I don't understand this. For example, both the Processes and Systemd-journal functions should be strictly read-only - so why is there a concern about "executing routines on the node"? Why doesn't other functions, like Block-devices or Mount-points, have this "problem"? It feels like some functions are just arbitrary set to require Cloud, just to force people to create and connect their local nodes to a Cloud account... Edit: additionally, "Processes", which requires Cloud, is handled by the plugin "apps". The documentation of "apps" even says:
(https://github.com/netdata/netdata/tree/master/src/collectors/apps.plugin#security) |
Beta Was this translation helpful? Give feedback.
-
|
Just like most open source services, if it was actually "for security purposes", they can literally make it possible to register a local account and solve the entire issue once and for all. |
Beta Was this translation helpful? Give feedback.
-
|
Having to register your account ON THE CLOUD on its own is a big f*ck you to security. |
Beta Was this translation helpful? Give feedback.
-
^^ This. Might seem blunt but how true it is, honestly. I emailed Netdata using their Contact Us option – a few reps on Reddit said invite people wanting to discuss plan options and figure out s solution that works for them to use the contact form. I did so, and gave my argument, including my willingness to agree to create a Netdata Cloud account and link up my devices, IF I could secure my account with additional layers or security and also be able to link up all of my local devices under their free plan. 2 weeks later, I have not received a reply. They're milking home users who probably aren't even their big money makers, and all of this new required plan stuff wasn't a thing a few years ago. If I was making money off their products, sure, I'll pay for it then, but I don't. I barely make enough money to pay myself, and some months, I don't even have money to do that. One of the reps, somewhere on Reddit, had stated sometime ago, that Netdata is open source and anyone can modify the code, and for that matter, I could create my own account service. Yeah, ok, because I have that level of programming experience to roll my own accounts solution. |
Beta Was this translation helpful? Give feedback.
-
|
Can we have any way (runtime is preferred, but compile time is also OK) to force-allow access to local functions like systemd-journald? This function can be disabled by default, but overridable with sudo rights. |
Beta Was this translation helpful? Give feedback.
-
|
any updates? |
Beta Was this translation helpful? Give feedback.
-
|
for real like forcing us to use their cloud services, like i can just go use a different metric monitoring, well time to uninstall. |
Beta Was this translation helpful? Give feedback.
-
|
Bump! |
Beta Was this translation helpful? Give feedback.
-
|
I've also been troubled by this issue and found a possible workaround. You need to fork the netdata code, modify the diff --git a/src/database/rrdfunctions-inflight.c b/src/database/rrdfunctions-inflight.c
index a14234bff431c5..885960b283d26c 100644
--- a/src/database/rrdfunctions-inflight.c
+++ b/src/database/rrdfunctions-inflight.c
@@ -438,48 +438,6 @@ int rrd_function_run(RRDHOST *host, BUFFER *result_wb, int timeout_s,
return code;
}
- if(!http_access_user_has_enough_access_level_for_endpoint(user_access, rdcf->access)) {
-
- if((rdcf->access & HTTP_ACCESS_SIGNED_ID) && !(user_access & HTTP_ACCESS_SIGNED_ID))
- code = rrd_call_function_error(result_wb,
- "You need to be authenticated via Netdata Cloud Single-Sign-On (SSO) "
- "to access this feature. Sign-in on this dashboard, "
- "or access your Netdata via https://app.netdata.cloud.",
- HTTP_ACCESS_PERMISSION_DENIED_HTTP_CODE(user_access));
-
- else if((rdcf->access & HTTP_ACCESS_SAME_SPACE) && !(user_access & HTTP_ACCESS_SAME_SPACE))
- code = rrd_call_function_error(result_wb,
- "You need to login to the Netdata Cloud space this agent is claimed to, "
- "to access this feature.",
- HTTP_ACCESS_PERMISSION_DENIED_HTTP_CODE(user_access));
-
- else if((rdcf->access & HTTP_ACCESS_COMMERCIAL_SPACE) && !(user_access & HTTP_ACCESS_COMMERCIAL_SPACE))
- code = rrd_call_function_error(result_wb,
- "This feature is only available for commercial users and supporters "
- "of Netdata. To use it, please upgrade your space. "
- "Thank you for supporting Netdata.",
- HTTP_ACCESS_PERMISSION_DENIED_HTTP_CODE(user_access));
-
- else {
- HTTP_ACCESS missing_access = (~user_access) & rdcf->access;
- char perms_str[1024];
- http_access2txt(perms_str, sizeof(perms_str), ", ", missing_access);
-
- char msg[2048];
- snprintfz(msg, sizeof(msg), "This feature requires additional permissions: %s.", perms_str);
-
- code = rrd_call_function_error(result_wb, msg,
- HTTP_ACCESS_PERMISSION_DENIED_HTTP_CODE(user_access));
- }
-
- dictionary_acquired_item_release(host->functions, host_function_acquired);
-
- if(result_cb)
- result_cb(result_wb, code, result_cb_data);
-
- return code;
- }
-
if(timeout_s <= 0)
timeout_s = rdcf->timeout;Configuring a complete build and packaging environment is cumbersome, but the compilation process can be handled on GitHub Actions. Although the pipeline may fail due to the absence of an official GPG key, you can still download the compiled deb package, like: https://github.com/lyc8503/netdata/actions/runs/17618181095/job/50056891375 Two important points to note:
Regardless, I've been using Netdata on my HomeLab for over seven years now. Its diagnostic capabilities and detailed metrics help me quickly resolve complex issues. I really like it. Though recent changes, including the tight coupling with Netdata Cloud and the removal of the open-source v1 dashboard, have left me somewhat disappointed. We hope Netdata will become more user-friendly for individual users in terms of its product and design, rather than rushing to promote Netdata Cloud and expensive subscription plans. |
Beta Was this translation helpful? Give feedback.
-
|
nice one! people certainly need a docker image of that! |
Beta Was this translation helpful? Give feedback.
-
I found some metrics missing when running in docker (even after mounting all required files), so I install Netdata directly on host. If you'd like to have a docker image, you can pull the Netdata repo, make the modification above and build it locally. It should be much easier to build locally with Docker. Dockerfile is located at |
Beta Was this translation helpful? Give feedback.
-
|
I'm happy I didn't install locally and just ran it as a docker container for testing. Thanks for the reports and confirm it's not really possible. |
Beta Was this translation helpful? Give feedback.
-
|
Good find, @lyc8503! It looks like a simpler change can instead be made to diff --git a/src/web/api/http_auth.h b/src/web/api/http_auth.h
index 0b01fdb1e..6c6f67802 100644
--- a/src/web/api/http_auth.h
+++ b/src/web/api/http_auth.h
@@ -15,7 +15,7 @@ time_t bearer_create_token(nd_uuid_t *uuid, HTTP_USER_ROLE user_role, HTTP_ACCES
bool web_client_bearer_token_auth(struct web_client *w, const char *v);
static inline bool http_access_user_has_enough_access_level_for_endpoint(HTTP_ACCESS user, HTTP_ACCESS endpoint) {
- return ((user & endpoint) == endpoint);
+ return true;
}This also unlocks the ability to mange collector configs from the UI as well. |
Beta Was this translation helpful? Give feedback.
-
|
I want to give thanks to both @The1hauntedX and @lyc8503 answers, and create an automated workflow for it:
# Cre: https://github.com/orgs/community/discussions/153608#discussioncomment-12453674
name: Sync Fork with Upstream
on:
schedule:
- cron: "0 0 * * *" # Runs daily at midnight UTC
workflow_dispatch: # Allows manual triggering
jobs:
sync:
runs-on: ubuntu-latest
steps:
- name: Configure Git
run: |
git config --global user.email "insert your email here"
git config --global user.name "insert your name here"
- name: Checkout Forked Repository
uses: actions/checkout@v6
with:
token: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
fetch-depth: 0
- name: Sync Upstream & Apply Patch
run: |
# 1. Fetch Upstream
git remote add upstream https://github.com/netdata/netdata.git
git fetch upstream master
# 2. Hard Reset: Wipe local history to match Upstream exactly
# This removes yesterday's patch commit so we don't get conflicts
git checkout master
git reset --hard upstream/master
# 3. Apply the Hack (sed)
echo "Applying auth bypass patch..."
sed -i 's/return ((user & endpoint) == endpoint);/return true;/' src/web/api/http_auth.h
# 4. Commit the changes
git add src/web/api/http_auth.h
git commit -m "feat: bypass Netdata Cloud sign-in which is required to access dashboard features"
# 5. Force Push
# We force push because we rewrote history (replaced yesterday's commit with today's)
git push origin master --force
Note If you're not using Ubuntu 24.04, refer to the artifact list at
sudo systemctl mask --now netdata-updater.timer
sudo systemctl mask --now netdata-updater.service
P/s: This 10-step workflows is my fight to vendor lock-in and attempt to try to make us stupid by saying cloud is necessary for basic auth. EDIT: I've updated a better CI/CD job that can avoid conflicts even if |
Beta Was this translation helpful? Give feedback.
-
|
@vhbui02 : Satya here and I head Product at Netdata. Thanks for the discussion — and here's a response just to clear things up 🙂 What's being talked about here isn't a bug or something that can be "configured away". The functionality in question is part of the Netdata Cloud / Enterprise UI, which is covered by the Netdata Cloud UI license: That license doesn't allow bypassing or disabling licensing or access controls, so we can't support or recommend doing that. It's also worth stressing that Netdata isn't "free or enterprise-only". We offer several options, depending on the use case:
If you want the advanced UI features without limitations, one of the Netdata Cloud plans — especially HomeLab for non-commercial use — is the supported way to get them. We're happy to help clarify what's included in each option or point you to a setup that fits your needs. Discussions or instructions about bypassing licensing, however, are out of scope and won't be supported here. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks, for clarifying that modifying GPL licensed code is "bypassing or disabling licensing or access controls". 🙂 |
Beta Was this translation helpful? Give feedback.
-
|
@DDoSolitary: There is a reason we have created multiple offerings - to try and fit in different requirements - Community, Homelab and Businesses. I understand your perspective but we do not want to continue the discussion on this thread discussing about bypassing our access controls (hope you understand). I am more than happy to get on a call and discuss the best way forward. We are in fact ideating an Enterprise Agent offering and it will be good to get some feedback from you. 😄 |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
I'm running Netdata in my own local network, yet the web UI says the following on some tabs like Top:
I'm on my local network, so why is Netdata stopping me from viewing info about my own computer? How can I disable this requirement to sign in? I don't want to have an account on a third-party server just to view my own computer's information.
It also says something about "claimed agents". I tried the
netdata-claim.shscript, but it says:So how am I going to use Netdata functions now without Cloud support? I would rather not connect to third-party servers. Anyone have an idea what to do here?
Beta Was this translation helpful? Give feedback.
All reactions