Skip to content
jaque

Security

jaque is pre-alpha, and its security posture is honest about that: there is no all-of-it authentication story, and the fix is architectural, not a missing flag. Read this before deciding what network a jaque process is allowed to sit on.

The one thing that’s authenticated

Section titled “The one thing that’s authenticated”

-api-token puts a bearer-token check in front of CommandService only — the RPCs that change state: ProcessCheckResult, AcknowledgeProblem, ScheduleDowntime, and the rest of the write surface. Set it and every command call needs a matching Authorization: Bearer <token> header, compared in constant time. Leave it empty (the default) and the command API is open.

Everything else is unauthenticated by design

Section titled “Everything else is unauthenticated by design”
  • QueryService — the read API backing the dashboard and any external tooling — carries no interceptor regardless of -api-token. It serves only projected, already-public monitoring state, so reads are always open.
  • /metrics and /status.json are unauthenticated HTTP endpoints on the same listener as the dashboard.
  • The dashboard itself (/) requires no login.
  • Livestatus (-livestatus-listen / -livestatus-socket) has no authentication at all — anything that can open the TCP address or the UNIX socket can query it.
  • The external command FIFO (-command-file) is created mode 0660, inherited unchanged from Nagios: file permissions and group ownership are the entire access-control story. Anyone able to write the file can drive jaque’s state.
  • Notification adapter secrets — -smtp-pass, -telegram-token, and the rest — arrive via flags or their JAQUE_-prefixed env vars, and are visible to anything that can read the process’s environment or command line (/proc/<pid>/environ, ps, a container platform’s own env inspection). jaque does not fetch them from a secret store.

The stated posture

Section titled “The stated posture”

Put a reverse proxy in front of anything you expose beyond localhost, and terminate TLS, authentication, and network exposure there — jaque itself does not do TLS. Treat the network a jaque process listens on as the perimeter: -listen, -livestatus-listen, and the FIFO’s containing directory should all sit behind whatever boundary (firewall, private subnet, UNIX socket permissions) keeps untrusted clients out, because jaque will not turn them away itself.

This is pre-alpha software. None of the above is a gap to be filed as a bug against a specific endpoint — it’s the current shape of the trust model, and it changes as the project matures past this stage.