We currently have anonymous access enabled in Nexus Repository, and we’re planning to disable it.
After checking with our DevOps team, I learned that our CI/CD pipelines are using a service account for authentication. However, before disabling anonymous access, I want to ensure that nothing else is still relying on anonymous access.
Is there a way to identify whether any users, groups, applications, or pipelines are currently accessing Nexus anonymously?
Specifically, I’m looking for answers to questions like:
Can Nexus logs or audit logs show anonymous requests?
Is there any report or metric that identifies anonymous access?
Has anyone gone through this transition, and what checks did you perform before disabling anonymous access?
Any recommendations or best practices would be appreciated. Thanks!
Hi, we went through this change quite recently and are still finding some small issues in less used pipelines. As Matthew mentioned, look at nexus.log and request.log and search for missing usernames (-) for request.
What really helped us was a one-time test run. I disabled anonymous access for one day and then restored it for another couple weeks before the final change. This helped uncover many forgotten usages and our devs appreciated it.
I also aimed at preparing sufficient docs for the newly required authentication, it isn’t always simple and otherwise frequently used for some of the formats (like apt), so I wanted to have it covered for all our use cases.