elastic / elastic/fleet-server
Log the public source IP of connected agents
- Dominant language
- Go
- Stars
- 113
- Forks
- 117
- Avg merge
- 1d 16h
- Merged PRs (30d)
- 112
Description
Users sometimes want this for audit logging. Internally in Elastic Cloud we rely on our proxy logs to obtain this information. Investigate if we can log this information directly from Fleet Server in Elastic Cloud, and outside of it.
Golang's [http.Request](https://pkg.go.dev/net/http#Request) allows us to get the source IP of the incoming request, but this is not necessarily the public or edge facing IP of the machine the agent is running on if the presence of proxies or load balancers
```go
// RemoteAddr allows HTTP servers and other software to record
// the network address that sent the request, usually for
// logging. This field is not filled in by ReadRequest and
// has no defined format. The HTTP server in this package
// sets RemoteAddr to an "IP:port" address before invoking a
// handler.
// This field is ignored by the HTTP client.
RemoteAddr [string](https://pkg.go.dev/builtin#string)
```
To get the source IP of the agent machine we could look at the `X-Forwarded-For` or a similar header, but it is only safe for us to use headers like this in Elastic Cloud where Elastic is in control of the proxy and the values set in this or other relevant headers. Headers can be set by any client in the request chain, regardless of if that client is trusted or malicious.
Contributor guide
Assessment
This issue has not been assessed yet.