Prometheus: Add authentication to Prometheus Node Exporter

This documentation is part of the Retrieving metrics from Linux guide. You can view the complete guide here: How to retrieve Linux server metrics in Prometheus using Node Exporter.

👋 Welcome to the Stackhero documentation!

Stackhero offers a ready-to-use Prometheus cloud solution designed for reliability and simplicity:

• Alert Manager is included, allowing you to send alerts directly to Slack, Mattermost, PagerDuty, and other popular platforms.
• A dedicated email server enables you to send unlimited email alerts with no additional configuration required.
• Blackbox is provided, so you can probe HTTP, ICMP, TCP, and more for comprehensive monitoring.
• Simple configuration with the online configuration file editor—no need to manage YAML manually.
• Easy updates with just one click.
• Optimal performance and enhanced security thanks to your own private, dedicated VM.

Save time and make your life easier: it takes just 5 minutes to try Stackhero's Prometheus cloud hosting solution!

By default, Node Exporter does not perform authentication, meaning anyone can retrieve the exposed metrics. To secure access, you can add basic authentication for a user.

Generating a random password

Generate a password using the following commands:

password=`openssl rand -base64 32`
passwordHashed=`echo ${password} | htpasswd -inBC 10 "" | tr -d ':'`
echo "Clear password to keep for Prometheus server: ${password}"

If you do not have the htpasswd binary, you can install it on Debian/Ubuntu using apt-get install --no-install-recommends apache2-utils.

Keep the clear password secure as you will need it when configuring Prometheus.

Adding the user and restarting Node Exporter

Append the following lines to the configuration file to add a user called "prometheus" with the generated password hash:

sudo cat << EOF >> /etc/prometheus_node_exporter/configuration.yml
basic_auth_users:
  prometheus: ${passwordHashed}

EOF

# Restart Node Exporter
sudo systemctl restart node_exporter

Finally, verify that authentication is working correctly:

• Running curl http://localhost:9100/metrics should return "Unauthorized".
• Running curl -u prometheus:${password} http://localhost:9100/metrics should return the list of metrics.