Security & Authentication

Security and Authentication in the pmm-dump tool focus on protecting credentials used for connecting to Percona Monitoring and Management (PMM) servers and their underlying data sources (VictoriaMetrics, ClickHouse, and PostgreSQL). The system implements several layers of defense, including credential redaction in logs and metadata, secure handling of environment variables, and strict file system permissions for generated dump archives.

The tool supports multiple authentication methods for PMM, including basic username/password, API tokens, and session cookies. It is designed to run in environments where security is a priority, ensuring that sensitive connection strings containing passwords do not leak into process lists or diagnostic output.

Authentication Mechanisms

The tool interacts primarily with the PMM Server via its Grafana-based API. It supports four distinct identification and authentication parameters which are encapsulated in the AuthParams structure.

Supported Authentication Types

Sources: cmd/pmm-dump/main.go:49-55, README.md:31-37

Credential Resolution Logic

The application utilizes a hierarchical approach to resolve the PMM URL and credentials. It can parse credentials directly from a provided --pmm-url or use individual flags. The parseURL function handles the extraction of user info from the URL string if explicit flags are absent.

Data Source Security

pmm-dump connects to various backend databases. Security for these connections is managed through standard URI-based authentication and environment variable fallbacks.

Configuration Fallbacks

If specific URLs for VictoriaMetrics, ClickHouse, or PostgreSQL are not provided via flags, the tool attempts to construct them using environment variables or by deriving them from the base PMM URL.

• ClickHouse: Uses PMM_CLICKHOUSE_URL or a combination of ADDR, USER, PASSWORD, and DATABASE variables. Defaults to user default and password clickhouse.
• PostgreSQL: Uses PMM_POSTGRES_URL or individual variables. It enforces an sslmode which defaults to disable but can be configured.
• VictoriaMetrics: Derived from the PMM URL by appending /prometheus.

Sources: pkg/util/util.go:50-136

Insecure Certificates

For environments using self-signed certificates, the tool provides an --allow-insecure-certs flag. When enabled, this configures the fasthttp.Client with TLSConfig{ InsecureSkipVerify: true }, bypassing standard certificate chain validation.
Sources: cmd/pmm-dump/util.go:51-62, cmd/pmm-dump/main.go:66-68

Leak Prevention & Redaction

A core security feature is the prevention of credential leakage in logs, process lists, and the meta.json file embedded within the dump.

URL Redaction

The redactURL function uses a regular expression (^(\w+://)[^@]+@) to strip sensitive user information from connection strings before they are logged or saved to metadata. This ensures that a connection string like http://admin:secret@host becomes http://***:***@host.

var urlRedactRe = regexp.MustCompile(`^(\w+://)[^@]+@`)

func redactURL(raw string) string {
	if !strings.Contains(raw, "@") {
		return raw
	}
	if !urlRedactRe.MatchString(raw) {
		return "***"
	}
	return urlRedactRe.ReplaceAllString(raw, "${1}***:***@")
}

Sources: cmd/pmm-dump/util.go:490-499

Process List Protection

To prevent credentials from appearing in the system process list (e.g., via ps or /proc/cmdline), the tool encourages the use of environment variables over CLI flags for sensitive data. Automated security tests verify that secret_user and secret_pass strings do not appear in the binary's command line environment when executed.
Sources: cmd/pmm-dump/security_test.go:34-64

System & File Security

Dump File Permissions

The tool ensures that exported metric data is protected at the file system level. Security tests enforce that the generated .tar.gz dump file is created with 0o600 permissions (read/write only by the owner).
Sources: cmd/pmm-dump/security_test.go:99-114

Database Role Initialization (MongoDB)

For internal testing and setup, the project defines a specific restricted role for MongoDB monitoring. The explainRole is limited to diagnostic actions, avoiding administrative privileges where possible.

Sources: setup/mongo/init.js:1-26

Security Verification Flow

The project includes a dedicated security test suite (//go:build security) that validates the following security properties:

Security and Authentication in pmm-dump are built around the principle of least exposure. By providing robust redaction for logs and metadata, supporting diverse authentication tokens, and strictly managing file permissions, the tool minimizes the risk of credential theft during metric export and import operations.