Skip to content

Commit

Permalink
feat(v5.2.1): add feishu alert & serverless support blacklist (#618)
Browse files Browse the repository at this point in the history
* feat(v5.2.1): add feishu alert & serverless support blacklist

* Editorial changes

---------

Co-authored-by: Meggielqk <[email protected]>
  • Loading branch information
0721Betty and Meggielqk authored Sep 29, 2024
1 parent 0c42092 commit 2189b8f
Show file tree
Hide file tree
Showing 12 changed files with 64 additions and 55 deletions.
30 changes: 13 additions & 17 deletions en_US/deployments/blacklist.md
Original file line number Diff line number Diff line change
@@ -1,35 +1,31 @@
<!-- markdownlint-disable MD001 -->

# Blacklist

The blacklist is used to prohibit client connections from being matched and is suitable for restricting a small number of clients. The control of the blacklist will expire after the validity period.

::: tip
The blacklist function only applies to Dedicated and Premium deployments.
:::
## Add Blacklist

From the left-navigation menu of EMQX Platform Console, selet **Access Control** -> **Blacklist**. Click **+ Add** on the top right to add a client to the blacklist.
From the left-navigation menu of EMQX Platform Console, select **Access Control** -> **Blacklist**. Click **+ Add** on the top right to add a client to the blacklist.

![blacklist](./_assets/blacklist_new.png)

**Type and Value**
### Type and Value

The client to be added to the blacklist can be identified by the following types. Select the type and set the value accordingly based on the requirements:

- Clinet ID: Letters, numbers and some special characters (_, -, /, +, #, $, %, @, & and .), up to 256 characters.
- Client ID: Letters, numbers and some special characters (_, -, /, +, #, $, %, @, & and .), up to 256 characters.
- Username: Letters, numbers and some special characters (_, -, /, +, #, $, %, @, & and .), up to 256 characters.
- Clinet IP: IPv4 address.
- Client IP: IPv4 address.

**Expiration Time**
### Expiration Time

The maximum expiration time is 1 year. The minimum expiration time is 5 minutes, and it cannot be earlier than the current time.
The maximum expiration time is 99 years. The minimum expiration time is 5 minutes, and it cannot be earlier than the current time.

**Note**
::: warning Note
EMQX Platform comes with a default "Flapping" protection mechanism. This mechanism aims to protect your broker from potential malicious connection attempts. If a client reconnects more than 120 times within one minute, it will be automatically added to the blacklist. The client ID will be retained in the blacklist for 60 minutes, during which time the specific client ID will be unable to reconnect to your deployment.

Optional.
If you believe this repetitive behavior is normal for the MQTT client, you can manually remove the client ID from the blacklist on the Blacklist page.
:::

::: warning
EMQX Platform comes with a default 'Flapping' protection mechanism. This mechanism aims to protect your broker from potential malicious connection attempts. If a client reconnects more than 120 times within one minute, it will be automatically added to the blacklist. The client ID will be retained in the blacklist for 60 minutes, during which time the specific client ID will be unable to reconnect to your deployment.
## Delete Blacklist

If you believe this repetitive behavior is normal for the MQTT client, you can visit the 'Blacklist' in the 'Authentication and Access Control' section and manually remove the client ID from the blacklist.
:::
In the blacklist list, find the blacklist to be deleted, and click the **Delete** icon in the operation column to delete it.
Binary file removed zh_CN/deployments/_assets/alert_events.png
Binary file not shown.
Binary file modified zh_CN/deployments/_assets/alert_hook_03.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file modified zh_CN/deployments/_assets/alert_hook_04.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file modified zh_CN/deployments/_assets/alert_hook_06.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file modified zh_CN/deployments/_assets/alert_hook_08.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added zh_CN/deployments/_assets/feishu-alert1.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added zh_CN/deployments/_assets/feishu-alert2.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added zh_CN/deployments/_assets/feishu-alert3.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
3 changes: 0 additions & 3 deletions zh_CN/deployments/alerts.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,6 @@

EMQX Platform 提供完善的告警提醒、告警集成,允许用户以及运维人员根据这些告警及时做出相应的处理。点击部署左侧菜单中的**监控** -> **告警**进入告警页面。在**告警列表**中可以查看到部署产生的告警信息,在**告警集成**中可以配置将告警发送到邮箱,或者通过集成 PagerDuty 或 Webhook 通知告警事件。

![alert_integrations](./_assets/alert_events.png)

## 告警事件

以下表格列举了 EMQX Platform 提供的部署告警事件以及相应的解决措施。
Expand Down Expand Up @@ -53,4 +51,3 @@ EMQX Platform 目前提供邮箱, PagerDuty 和 Webhook 事件告警集成。
### Webhook 集成

关于 Webhook 集成告警的详细内容,参阅[集成 Webhook 告警](./alerts_webhook.md)

60 changes: 40 additions & 20 deletions zh_CN/deployments/alerts_webhook.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,41 +5,61 @@ EMQX Platform 可以集成 Webhook,支持将告警发送到通信软件或是
## 向企业微信发送告警消息

1. 在企业微信群中创建机器人(需要是群主身份才能创建), 选择 `添加群机器人` -> `新创建一个机器人` -> `添加机器人`。详细请参考 [群机器人配置说明](https://developer.work.weixin.qq.com/document/path/91770)
![webhook01](./_assets/alert_hook_01.png)
<img src="./_assets/alert_hook_01.png" alt="add-wechat-robot" style="zoom:50%;" />

2. 完成微信机器人的创建,复制链接。
![webhook02](./_assets/alert_hook_02.png)
1. 完成微信机器人的创建,复制链接。
<img src="./_assets/alert_hook_02.png" alt="wechat-robot-webhook" style="zoom:50%;" />

3. 在 Webhook 告警中,选择企业微信,并填入告警名称和 Webhook 地址,完成配置。
![webhook03](./_assets/alert_hook_03.png)
1. 在 Webhook 告警中,选择企业微信,并填入告警名称和 Webhook 地址,完成配置。
<img src="./_assets/alert_hook_03.png" alt="add-wechat-alert" style="zoom:50%;" />

1. 验证配置。可以通过测试功能,选择配置好的 Webhook 告警,即可发送默认消息检测是否配置成功。
<img src="./_assets/alert_hook_05.png" alt="verify-alert" style="zoom:50%;" />

4. 验证配置,可以通过测试功能,选择配置好的 Webhook 告警,即可发送默认消息检测是否配置成功。
## 向钉钉发送告警消息

![webhook05](./_assets/alert_hook_05.png)
1. 在钉钉中创建 Webhook 机器人,请参考[官方文档](https://open.dingtalk.com/document/robots/custom-robot-access)创建。
2. 复制机器人的 Webhook 地址,在告警配置中,选择钉钉,并填入告警名称和 Webhook 地址,完成配置。
<img src="./_assets/alert_hook_04.png" alt="add-ding-talk-alert" style="zoom:50%;" />
3. 钉钉需要安全设置中定义`自定义关键词` ,建议将关键词设置为: `EMQ`或者`告警`
4. 验证配置。可以通过测试功能,选择配置好的 Webhook 告警,即可发送默认消息检测是否配置成功。

## 向飞书发送告警消息

## 向钉钉发送告警消息
1. 在飞书中创建 Webhook 机器人指令,请参考[官方文档](https://www.feishu.cn/hc/zh-CN/articles/807992406756-webhook-%E8%A7%A6%E5%8F%91%E5%99%A8)创建。

1. 在钉钉中创建 Webhook 机器人,请参考[官方文档](https://open.dingtalk.com/document/robots/custom-robot-access)创建;
2. 复制机器人的 Webhook 地址,在告警配置中,选择钉钉,并填入告警名称和 Webhook 地址,完成配置;
![webhook04](./_assets/alert_hook_04.png)
3. 钉钉需要安全设置中定义`自定义关键词` ,建议将关键词设置为: `EMQ`或者`告警`
4. 验证配置,可以通过测试功能,选择配置好的 Webhook 告警,即可发送默认消息检测是否配置成功。
- 添加 Webhook 触发器,参数填写如下:

```json
{
"subject": "",
"message": ""
}
```

<img src="./_assets/feishu-alert1.png" alt="config feishu webhook" style="zoom:50%;" />

- 添加**通过官方机器人发消息**的操作,**消息标题**选择 `Webhook 触发 - subject`,**消息内容**选择 `Webhook 触发 - message`。

<img src="./_assets/feishu-alert2.png" alt="config feishu message" style="zoom:50%;" />

2. 复制指令中的 Webhook 地址,在添加 Webhook 集成的配置中,选择`飞书`,并填入告警的名称和请求地址,完成配置。

3. 验证配置。可以通过测试功能,选择配置好的 Webhook 告警,即可发送默认消息检测是否配置成功。
<img src="./_assets/feishu-alert3.png" alt="verify feishu alert" style="zoom:50%;" />

## 向 Slack 发送告警消息

1. 在 Slack 创建 Webhook,获取 Webhook URL 地址。更多信息,请参见 [Sending messages using Incoming Webhooks](https://api.slack.com/messaging/webhooks?spm=a2c4g.11186623.0.0.2fa63db5J0PRQp)。
2. 复制 Webhook API 地址,在告警配置中,选择 Slack,并填入告警名称和 Webhook 地址,完成配置。
![webhook08](./_assets/alert_hook_08.png)
3. 验证配置可以通过测试功能,选择配置好的 Webhook 告警,即可发送默认消息检测是否配置成功。
<img src="./_assets/alert_hook_08.png" alt="add slack alert" style="zoom:50%;" />
3. 验证配置可以通过测试功能,选择配置好的 Webhook 告警,即可发送默认消息检测是否配置成功。

## 向自定义服务发送告警消息

除了向通讯软件中的机器人发送告警消息,我们还可以向自己的服务通过 Webhook 发送消息。

1. 首先需要搭建好服务能接收和处理请求,在新建对话框中选择 `通用 Webhook`。
2. 在新建对话框中填入 Webhook 服务的请求地址。同时也可以额外添加请求头的键和值。
![webhook06](./_assets/alert_hook_06.png)
3. 验证配置,可以通过测试功能,选择配置好的 Webhook 告警,即可发送默认消息检测是否配置成功。



<img src="./_assets/alert_hook_06.png" alt="add webhook alert" style="zoom:50%;" />
3. 验证配置。可以通过测试功能,选择配置好的 Webhook 告警,即可发送默认消息检测是否配置成功。
26 changes: 11 additions & 15 deletions zh_CN/deployments/blacklist.md
Original file line number Diff line number Diff line change
@@ -1,35 +1,31 @@
<!-- markdownlint-disable MD001 -->

# 黑名单

黑名单用于禁止匹配的客户端建立连接,该功能适用于对少量客户端做限制。黑名单的管控将在有效期到期后失效。

::: tip
黑名单为专有版功能。
:::
## 添加黑名单

在控制台的左侧菜单中选择 **访问控制** -> **黑名单**。点击**黑名单**页面右上角的**+ 添加**创建黑名单。在弹出的对话框中填写必填和选填信息
在控制台的左侧菜单中选择**访问控制** -> **黑名单**。点击**黑名单**页面右上角的**添加**按钮新增黑名单。在弹出的对话框中填写相关信息

![blacklist](./_assets/blacklist_new.png)

**黑名单类型和目标值**
### 黑名单类型和目标值

系统会根据以下不同类型识别被加入黑名单的客户端。根据所选的黑名单类型按要求设置目标值:

- 客户端 ID:可包含字母、数字和部分特殊字符(_、-、/、+、#、$、%、@、& 和 .),最长 128 个字符。
- 用户名 : 可包含字母、数字和部分特殊字符(_、-、/、+、#、$、%、@、& 和 .),最长 128 个字符。
- 客户端 IP :支持 IPv4 的地址。

**到期时间**
### 到期时间

到期时间最大值为 1 年,最小值为 5 分钟,且不能早于当前的时间点。
到期时间最大值为 99 年,最小值为 5 分钟,且不能早于当前的时间点。

**备注**
::: warning 注意
EMQX 部署自带默认的 "Flapping" 保护机制。该机制旨在保护您的 Broker 免受潜在的恶意连接尝试。如果客户端在一分钟内反复重连超过 120 次,就会被自动加入黑名单。该客户端 ID 将在黑名单中保留 60 分钟,在此期间特定的客户端 ID 将无法重新连接到您的部署。

可选择填写。
如果您认为这种重复行为对 MQTT 客户端来说是正常的,您可以在黑名单页面上手动将该客户端 ID 从黑名单中删除。
:::

::: warning
EMQX 部署自带默认的 "Flapping"保护机制。该机制旨在保护您的 Broker 免受潜在的恶意连接尝试。如果客户端在一分钟内反复重连超过 120 次,就会被自动加入黑名单。该Clientid将在黑名单中保留 60 分钟,在此期间特定的Clientid将无法重新连接到您的部署。
## 删除黑名单

如果您认为这种重复行为对 MQTT 客户端来说是正常的,您可以访问 "认证和访问控制"部分的 "黑名单",手动将该Clientid从黑名单中删除。
:::
在黑名单列表中找到要删除的黑名单,点击操作列的**删除**图标即可删除。

0 comments on commit 2189b8f

Please sign in to comment.