Security

Receiver security

To prevent malicious attacks, the gRPC listener is by default only opened on localhost:

  otlp:
    protocols:
      grpc:
        endpoint: localhost:4317

Transport security

Hardware Sentry secures the communications instantiated from the Hardware Sentry Agent's internal OTLP Exporter to the OpenTelemetry Collector's internal OTLP gRPC Receiver through TLS.

The OTLP gRPC Receiver is configured as follows in the otel/otel-config.yaml file:

  otlp:
    protocols:
      grpc:
        endpoint: localhost:4317
        tls:
          cert_file: ../security/otel.crt
          key_file: ../security/otel.key

To customize the default TLS settings, see Customizing TLS Certificates.

Requests authentication

Once TLS is established, the OTLP gRPC Receiver uses the basicauth authenticator to authenticate any incoming request:

  otlp:
    protocols:
      grpc:
        endpoint: localhost:4317
        tls:
          cert_file: ../security/otel.crt
          key_file: ../security/otel.key
        auth:
          authenticator: basicauth

To customize the default authentication secret, see Customizing OTLP Authentication Password.