Admin API security

[subnetmarco]

In kong.yml it would be nice to have a configuration entry that protects the management API, for example:

admin_allowed_ips:
  - 127.0.0.1
  - 192.168.0.0/16

[subnetmarco]

Maybe this could be a plugin?

[ahmadnassri]

+1 for plugin.

by default localhost, plugin to manage additional sources.

[sonicaghi]

EVERYTHING should be a plugin. the core kong as lightweight as possible.

[sonicaghi]

API Admin plugin

[montanaflynn]

by default localhost, plugin to manage additional sources.

I like default how it is currently. Anyone in production will set up appropriate firewalls using iptables, AWS security groups, or running their Kong(s) in an internal private network which is blocked off from public access except for port 80.

I agree with the plugin, it would be nice to have a whitelist & blacklist plus support for matching subnets. This would allow us to be on par with nginx's ngx_http_access_module, and should be introduced not only for the admin API but also as a plugin available for all user created APIs.

[subnetmarco]

It's related to #379.

[subnetmarco]

We should find a way to use existing plugins for the admin API. @thibaultcha Including CORS, user authentication, IP whitelisting/blacklisting, etc. While still having the admin running separately.

This means that the plugin execution handlers in kong.lua need to be also used in the content_by_lua of the admin server on port 8001. As opposed to the server on port 8000, we decide which plugins are running and are installed on the Admin API (opened #380).

[sonicaghi]

^

Kong Shield: can be new commercial solution.

Enterprise Admin Governance.

[sgulics]

How are people securing the admin api in production environments? I would assume that if someone added/changed/deleted an API through the ADMIN API, you would want to know who did it.

[thibaultcha]

They put the port behind a firewall for internal usage only.

[subnetmarco]

@sgulics as per proper authentication and activity logging, this is related to #380

[p0pr0ck5]

We have published a doc that highlights some of the best practices we suggest when considering securing the Admin API: https://getkong.org/docs/0.10.x/secure-admin-api/

[p0pr0ck5]

Worth noting here that Kong Enterprise now supports RBAC!

Not sure how much value is left in keeping this issue open...