Error: Unauthorized access to GPCC Prometheus metrics ports 6162 and 6163

Products

• VMware Tanzu Greenplum
• VMware Tanzu Greenplum / Gemfire

Issue/Introduction

Internal security vulnerability scans may report a risk regarding unauthenticated access to Greenplum Command Center (GPCC) ports 6162 and 6163. These ports are used by the Prometheus metrics exporter and, depending on the configuration, may allow unauthorized scraping of system metrics.

Cause

The GPCC Prometheus exporter endpoints (/cluster_metrics, /table_metrics) are exposed on ports 6162 and 6163. By default, authentication may not be enforced unless a security token is explicitly configured in the environment.

Resolution

Use one of the following methods to mitigate the security risk.

Method 1: Enable Bearer Token Authentication (Recommended)

Configure a security token to require authentication for all metrics requests.

1. Open the configuration file: $HOME/gpmetrics/gpcc.conf.
2. Add or update the [metrics_export] section:

[metrics_export]
enable_greenplum_exporter = true
metrics_token = ####  # Enter a secure custom token

3. Restart GPCC:

gpcc stop
gpcc start

4. Verify that access without a token returns a 401 Unauthorized error:

curl -i http://localhost:6162/metrics

Method 2: Disable the Performance Ports

If Prometheus monitoring is not required, disable the ports entirely by modifying the GPCC application configuration.

1. Edit the app.conf file in the GPCC installation directory.
2. Modify the performance port parameters to -1:

ws_perf_port = -1
agent_perf_port = -1

3. Restart GPCC to apply changes.

Additional Information

• For further assistance, see Contact Support. Scroll to the bottom of the page and click on your respective region.