Security

Built so your data never leaves your hands.

RackMon is self-hosted by design. It runs entirely on your infrastructure, and its security model assumes you, not a vendor, are in control.

Self-hosted, no phone-home

Your monitoring data (devices, metrics, alerts) stays in your own database on your own server. RackMon never sends it anywhere.
There is no telemetry. The only optional outbound call is an update check — a plain GET of a small public JSON manifest, off by default, that sends no data about your install.
The in-app support form only sends when a human clicks send. What goes with your message: the reply-to address, your role in the instance, the version and an instance identifier. Not your device list, not your telemetry. The privacy policy spells out the exact fields.

Secrets encrypted at rest

Device and SMTP credentials are encrypted with AES-256-GCM using a master key you provide (RACKMON_MASTER_KEY), which is kept out of the database. Session tokens are signed with a separate secret (RACKMON_JWT_SECRET).

Safe by default in production. With RACKMON_ENVIRONMENT=production, RackMon refuses to start while RACKMON_JWT_SECRET, RACKMON_MASTER_KEY or RACKMON_ADMIN_PASSWORD is still on its development default — a misconfigured instance fails closed instead of running exposed. Placeholder secrets copied from an install template (CHANGE-ME…) are refused in every environment, because that string is published.

The read-only account is not created with a factory password. Earlier versions always seeded viewer@rackmon.io with a password that was printed on this very site. From 1.2.3 that account is only created when you set RACKMON_VIEWER_PASSWORD yourself; if an older install still has it and the password is still the published one, RackMon disables the account on the next start and says so in the log. An account whose password you changed is left alone.

Authentication & access control

Password login with lockout after repeated failures; TOTP two-factor available.
API keys for automation, role-based access control (admin / operator / viewer), and a full audit log of sensitive actions.
SNMP v3 (authPriv) for encrypted device polling.
LDAP / Active Directory and OpenID Connect (OIDC) single sign-on, with ID-token signatures verified against the provider's JWKS — included, like everything else.

No licence check, because there is no licence

RackMon is MIT-licensed and every feature is on by default, so there is no key to verify, no signing code in the image and no edition check anywhere in the request path. RACKMON_LICENSE_KEY is still read so that an upgrade from an older install does not fail, and its value is ignored.

Transport & deployment

Run RackMon behind a TLS-terminating reverse proxy (Caddy, nginx, Traefik) so all traffic is HTTPS.
The container runs as a non-root user. Expose only the ports you need.
Keep current: docker pull rackmon/rackmon:latest to receive security fixes.

Reporting a vulnerability

Found a security issue? Email rackmon.software@gmail.com with the details and the steps to reproduce, or open a private advisory on GitHub. I acknowledge reports and keep you posted; please leave a reasonable window before public disclosure. Credit where you want it.

Past advisories

Fixed issues are listed here rather than quietly patched, because an operator deciding whether to upgrade deserves to know what they are upgrading away from.

Version	Issue
1.3.0	The factory administrator came back on every restart. `seed_all()` recreated the account whenever its configured email was missing, so renaming it to your own address — or deleting it after creating your own — handed the next restart a fresh admin with the default password. Now the account is only seeded when the installation has no administrator at all.
1.2.10	Arbitrary file read without an account, in every version up to and including 1.2.9. The catch-all route that serves the web UI joined the request path onto the static directory without normalising it, so an encoded `../` escaped the directory and returned any file the process could read — including the `.env` with `RACKMON_JWT_SECRET` and `RACKMON_MASTER_KEY`. Upgrade, and rotate both secrets.
1.2.10	The update check pointed at `rackmon.io`, a domain I do not own. No announcement ever reached an install that had not overridden it by hand — including an announcement about the entry above. The manifest now lives at `rackmon.app`.
1.2.9	A Pro licence key signed with the real vendor key was committed in `backend/tests/conftest.py`, and that file shipped inside every published Docker image. The key is revoked; the test suite now signs an ephemeral pair per run.
1.2.3	The read-only account was always created with a password published on this very site. It is now only created when you set `RACKMON_VIEWER_PASSWORD` yourself, and an older install still carrying the published one has it disabled on the next start.

← Back to RackMon