From a1dd587d6a5204030bc266d371e6ec9fa7c95d7b Mon Sep 17 00:00:00 2001 From: Edwin Lawrance Date: Tue, 5 Mar 2019 10:30:33 +0000 Subject: Add Searchguard OOM config to ElasticSearch Change-Id: I3c4d0c82882b2f064a6ad3610c0f699d8af50632 Issue-ID: AAI-2203 Signed-off-by: Edwin Lawrance --- .../resources/config/sg/auth/esaai-keystore.jks | Bin 0 -> 3979 bytes .../resources/config/sg/auth/sgadmin-keystore.p12 | Bin 0 -> 4575 bytes .../resources/config/sg/auth/truststore.jks | Bin 0 -> 930 bytes .../resources/config/sg/sg_action_groups.yml | 137 +++++++++++ .../resources/config/sg/sg_config.yml | 221 +++++++++++++++++ .../resources/config/sg/sg_internal_users.yml | 45 ++++ .../resources/config/sg/sg_roles.yml | 262 +++++++++++++++++++++ .../resources/config/sg/sg_roles_mapping.yml | 38 +++ 8 files changed, 703 insertions(+) create mode 100644 kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/auth/esaai-keystore.jks create mode 100644 kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/auth/sgadmin-keystore.p12 create mode 100644 kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/auth/truststore.jks create mode 100644 kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_action_groups.yml create mode 100644 kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_config.yml create mode 100644 kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_internal_users.yml create mode 100644 kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_roles.yml create mode 100644 kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_roles_mapping.yml (limited to 'kubernetes/aai/charts/aai-elasticsearch/resources/config/sg') diff --git a/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/auth/esaai-keystore.jks b/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/auth/esaai-keystore.jks new file mode 100644 index 0000000000..21ec9bba97 Binary files /dev/null and b/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/auth/esaai-keystore.jks differ diff --git a/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/auth/sgadmin-keystore.p12 b/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/auth/sgadmin-keystore.p12 new file mode 100644 index 0000000000..db7cbf401c Binary files /dev/null and b/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/auth/sgadmin-keystore.p12 differ diff --git a/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/auth/truststore.jks b/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/auth/truststore.jks new file mode 100644 index 0000000000..b3bd666652 Binary files /dev/null and b/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/auth/truststore.jks differ diff --git a/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_action_groups.yml b/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_action_groups.yml new file mode 100644 index 0000000000..be5901a559 --- /dev/null +++ b/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_action_groups.yml @@ -0,0 +1,137 @@ +UNLIMITED: + readonly: true + permissions: + - "*" + +###### INDEX LEVEL ###### + +INDICES_ALL: + readonly: true + permissions: + - "indices:*" + +# for backward compatibility +ALL: + readonly: true + permissions: + - INDICES_ALL + +MANAGE: + readonly: true + permissions: + - "indices:monitor/*" + - "indices:admin/*" + +CREATE_INDEX: + readonly: true + permissions: + - "indices:admin/create" + - "indices:admin/mapping/put" + +MANAGE_ALIASES: + readonly: true + permissions: + - "indices:admin/aliases*" + +# for backward compatibility +MONITOR: + readonly: true + permissions: + - INDICES_MONITOR + +INDICES_MONITOR: + readonly: true + permissions: + - "indices:monitor/*" + +DATA_ACCESS: + readonly: true + permissions: + - "indices:data/*" + - CRUD + +WRITE: + readonly: true + permissions: + - "indices:data/write*" + - "indices:admin/mapping/put" + +READ: + readonly: true + permissions: + - "indices:data/read*" + - "indices:admin/mappings/fields/get*" + +DELETE: + readonly: true + permissions: + - "indices:data/write/delete*" + +CRUD: + readonly: true + permissions: + - READ + - WRITE + +SEARCH: + readonly: true + permissions: + - "indices:data/read/search*" + - "indices:data/read/msearch*" + - SUGGEST + +SUGGEST: + readonly: true + permissions: + - "indices:data/read/suggest*" + +INDEX: + readonly: true + permissions: + - "indices:data/write/index*" + - "indices:data/write/update*" + - "indices:admin/mapping/put" + - "indices:data/write/bulk*" + +GET: + readonly: true + permissions: + - "indices:data/read/get*" + - "indices:data/read/mget*" + +###### CLUSTER LEVEL ###### + +CLUSTER_ALL: + readonly: true + permissions: + - "cluster:*" + +CLUSTER_MONITOR: + readonly: true + permissions: + - "cluster:monitor/*" + +CLUSTER_COMPOSITE_OPS_RO: + readonly: true + permissions: + - "indices:data/read/mget" + - "indices:data/read/msearch" + - "indices:data/read/mtv" + - "indices:data/read/coordinate-msearch*" + - "indices:admin/aliases/exists*" + - "indices:admin/aliases/get*" + - "indices:data/read/scroll" + +CLUSTER_COMPOSITE_OPS: + readonly: true + permissions: + - "indices:data/write/bulk" + - "indices:admin/aliases*" + - "indices:data/write/reindex" + - CLUSTER_COMPOSITE_OPS_RO + +MANAGE_SNAPSHOTS: + readonly: true + permissions: + - "cluster:admin/snapshot/*" + - "cluster:admin/repository/*" \ No newline at end of file diff --git a/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_config.yml b/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_config.yml new file mode 100644 index 0000000000..3fefe1690d --- /dev/null +++ b/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_config.yml @@ -0,0 +1,221 @@ +# This is the main Search Guard configuration file where authentication +# and authorization is defined. +# +# You need to configure at least one authentication domain in the authc of this file. +# An authentication domain is responsible for extracting the user credentials from +# the request and for validating them against an authentication backend like Active Directory for example. +# +# If more than one authentication domain is configured the first one which succeeds wins. +# If all authentication domains fail then the request is unauthenticated. +# In this case an exception is thrown and/or the HTTP status is set to 401. +# +# After authentication authorization (authz) will be applied. There can be zero or more authorizers which collect +# the roles from a given backend for the authenticated user. +# +# Both, authc and auth can be enabled/disabled separately for REST and TRANSPORT layer. Default is true for both. +# http_enabled: true +# transport_enabled: true +# +# 5.x Migration: "enabled: true/false" will also be respected currently but only to provide backward compatibility. +# +# For HTTP it is possible to allow anonymous authentication. If that is the case then the HTTP authenticators try to +# find user credentials in the HTTP request. If credentials are found then the user gets regularly authenticated. +# If none can be found the user will be authenticated as an "anonymous" user. This user has always the username "sg_anonymous" +# and one role named "sg_anonymous_backendrole". +# If you enable anonymous authentication all HTTP authenticators will not challenge. +# +# +# Note: If you define more than one HTTP authenticators make sure to put non-challenging authenticators like "proxy" or "clientcert" +# first and the challenging one last. +# Because it's not possible to challenge a client with two different authentication methods (for example +# Kerberos and Basic) only one can have the challenge flag set to true. You can cope with this situation +# by using pre-authentication, e.g. sending a HTTP Basic authentication header in the request. +# +# Default value of the challenge flag is true. +# +# +# HTTP +# basic (challenging) +# proxy (not challenging, needs xff) +# kerberos (challenging) NOT FREE FOR COMMERCIAL +# clientcert (not challenging, needs https) +# jwt (not challenging) NOT FREE FOR COMMERCIAL +# host (not challenging) #DEPRECATED, will be removed in a future version. +# host based authentication is configurable in sg_roles_mapping + +# Authc +# internal +# noop +# ldap NOT FREE FOR COMMERCIAL USE + +# Authz +# ldap NOT FREE FOR COMMERCIAL USE +# noop + +searchguard: + dynamic: + # Set filtered_alias_mode to 'disallow' to forbid more than 2 filtered aliases per index + # Set filtered_alias_mode to 'warn' to allow more than 2 filtered aliases per index but warns about it (default) + # Set filtered_alias_mode to 'nowarn' to allow more than 2 filtered aliases per index silently + #filtered_alias_mode: warn + #kibana: + # Kibana multitenancy - NOT FREE FOR COMMERCIAL USE + # see https://github.com/floragunncom/search-guard-docs/blob/master/multitenancy.md + # To make this work you need to install https://github.com/floragunncom/search-guard-module-kibana-multitenancy/wiki + #multitenancy_enabled: true + #server_username: kibanaserver + #index: '.kibana' + #do_not_fail_on_forbidden: false + http: + anonymous_auth_enabled: false + xff: + enabled: false + internalProxies: '192\.168\.0\.10|192\.168\.0\.11' # regex pattern + #internalProxies: '.*' # trust all internal proxies, regex pattern + remoteIpHeader: 'x-forwarded-for' + proxiesHeader: 'x-forwarded-by' + #trustedProxies: '.*' # trust all external proxies, regex pattern + ###### see https://docs.oracle.com/javase/7/docs/api/java/util/regex/Pattern.html for regex help + ###### more information about XFF https://en.wikipedia.org/wiki/X-Forwarded-For + ###### and here https://tools.ietf.org/html/rfc7239 + ###### and https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Remote_IP_Valve + authc: + kerberos_auth_domain: + http_enabled: false + transport_enabled: false + order: 6 + http_authenticator: + type: kerberos # NOT FREE FOR COMMERCIAL USE + challenge: true + config: + # If true a lot of kerberos/security related debugging output will be logged to standard out + krb_debug: false + # If true then the realm will be stripped from the user name + strip_realm_from_principal: true + authentication_backend: + type: noop + basic_internal_auth_domain: + http_enabled: true + transport_enabled: true + order: 2 + http_authenticator: + type: basic + challenge: true + authentication_backend: + type: intern + proxy_auth_domain: + http_enabled: false + transport_enabled: false + order: 3 + http_authenticator: + type: proxy + challenge: false + config: + user_header: "x-proxy-user" + roles_header: "x-proxy-roles" + authentication_backend: + type: noop + jwt_auth_domain: + http_enabled: false + transport_enabled: false + order: 0 + http_authenticator: + type: jwt + challenge: false + config: + signing_key: "base64 encoded HMAC key or public RSA/ECDSA pem key" + jwt_header: "Authorization" + jwt_url_parameter: null + roles_key: null + subject_key: null + authentication_backend: + type: noop + clientcert_auth_domain: + http_enabled: true + transport_enabled: true + order: 1 + http_authenticator: + type: clientcert + config: + username_attribute: cn #optional, if omitted DN becomes username + challenge: false + authentication_backend: + type: noop + ldap: + http_enabled: false + transport_enabled: false + order: 5 + http_authenticator: + type: basic + challenge: false + authentication_backend: + # LDAP authentication backend (authenticate users against a LDAP or Active Directory) + type: ldap # NOT FREE FOR COMMERCIAL USE + config: + # enable ldaps + enable_ssl: false + # enable start tls, enable_ssl should be false + enable_start_tls: false + # send client certificate + enable_ssl_client_auth: false + # verify ldap hostname + verify_hostnames: true + hosts: + - localhost:8389 + bind_dn: null + password: null + userbase: 'ou=people,dc=example,dc=com' + # Filter to search for users (currently in the whole subtree beneath userbase) + # {0} is substituted with the username + usersearch: '(sAMAccountName={0})' + # Use this attribute from the user as username (if not set then DN is used) + username_attribute: null + authz: + roles_from_myldap: + http_enabled: false + transport_enabled: false + authorization_backend: + # LDAP authorization backend (gather roles from a LDAP or Active Directory, you have to configure the above LDAP authentication backend settings too) + type: ldap # NOT FREE FOR COMMERCIAL USE + config: + # enable ldaps + enable_ssl: false + # enable start tls, enable_ssl should be false + enable_start_tls: false + # send client certificate + enable_ssl_client_auth: false + # verify ldap hostname + verify_hostnames: true + hosts: + - localhost:8389 + bind_dn: null + password: null + rolebase: 'ou=groups,dc=example,dc=com' + # Filter to search for roles (currently in the whole subtree beneath rolebase) + # {0} is substituted with the DN of the user + # {1} is substituted with the username + # {2} is substituted with an attribute value from user's directory entry, of the authenticated user. Use userroleattribute to specify the name of the attribute + rolesearch: '(member={0})' + # Specify the name of the attribute which value should be substituted with {2} above + userroleattribute: null + # Roles as an attribute of the user entry + userrolename: disabled + #userrolename: memberOf + # The attribute in a role entry containing the name of that role, Default is "name". + # Can also be "dn" to use the full DN as rolename. + rolename: cn + # Resolve nested roles transitive (roles which are members of other roles and so on ...) + resolve_nested_roles: true + userbase: 'ou=people,dc=example,dc=com' + # Filter to search for users (currently in the whole subtree beneath userbase) + # {0} is substituted with the username + usersearch: '(uid={0})' + # Skip users matching a user name, a wildcard or a regex pattern + #skip_users: + # - 'cn=Michael Jackson,ou*people,o=TEST' + # - '/\S*/' + roles_from_another_ldap: + enabled: false + authorization_backend: + type: ldap # NOT FREE FOR COMMERCIAL USE + #config goes here ... diff --git a/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_internal_users.yml b/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_internal_users.yml new file mode 100644 index 0000000000..942a7164aa --- /dev/null +++ b/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_internal_users.yml @@ -0,0 +1,45 @@ +# This is the internal user database +# The hash value is a bcrypt hash and can be generated with plugin/tools/hash.sh + +#password is: admin +admin: + readonly: true + hash: $2a$12$VcCDgh2NDk07JGN0rjGbM.Ad41qVR/YFJcgHp0UGns5JDymv..TOG + roles: + - admin + attributes: + #no dots allowed in attribute names + attribute1: value1 + attribute2: value2 + attribute3: value3 + +#password is: logstash +logstash: + hash: $2a$12$u1ShR4l4uBS3Uv59Pa2y5.1uQuZBrZtmNfqB3iM/.jL0XoV9sghS2 + roles: + - logstash + +#password is: kibanaserver +kibanaserver: + readonly: true + hash: $2a$12$4AcgAt3xwOWadA5s5blL6ev39OXDNhmOesEoo33eZtrq2N0YrU3H. + +#password is: kibanaro +kibanaro: + hash: $2a$12$JJSXNfTowz7Uu5ttXfeYpeYE0arACvcwlPBStB1F.MI7f0U9Z4DGC + roles: + - kibanauser + - readall + +#password is: readall +readall: + hash: $2a$12$ae4ycwzwvLtZxwZ82RmiEunBbIPiAmGZduBAjKN0TXdwQFtCwARz2 + #password is: readall + roles: + - readall + +#password is: snapshotrestore +snapshotrestore: + hash: $2y$12$DpwmetHKwgYnorbgdvORCenv4NAK8cPUg8AI6pxLCuWf/ALc0.v7W + roles: + - snapshotrestore \ No newline at end of file diff --git a/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_roles.yml b/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_roles.yml new file mode 100644 index 0000000000..c918e851f1 --- /dev/null +++ b/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_roles.yml @@ -0,0 +1,262 @@ +# Allows everything, but no changes to searchguard configuration index +sg_all_access: + readonly: true + cluster: + - UNLIMITED + indices: + '*': + '*': + - UNLIMITED + tenants: + admin_tenant: RW + +# Read all, but no write permissions +sg_readall: + readonly: true + cluster: + - CLUSTER_COMPOSITE_OPS_RO + indices: + '*': + '*': + - READ + +# Read all and monitor, but no write permissions +sg_readall_and_monitor: + cluster: + - CLUSTER_MONITOR + - CLUSTER_COMPOSITE_OPS_RO + indices: + '*': + '*': + - READ + +# For users which use kibana, access to indices must be granted separately +sg_kibana_user: + readonly: true + cluster: + - INDICES_MONITOR + - CLUSTER_COMPOSITE_OPS + indices: + '?kibana': + '*': + - MANAGE + - INDEX + - READ + - DELETE + '?kibana-6': + '*': + - MANAGE + - INDEX + - READ + - DELETE + '?kibana_*': + '*': + - MANAGE + - INDEX + - READ + - DELETE + '?tasks': + '*': + - INDICES_ALL + '?management-beats': + '*': + - INDICES_ALL + '*': + '*': + - indices:data/read/field_caps* + - indices:data/read/xpack/rollup* + - indices:admin/mappings/get* + - indices:admin/get + +# For the kibana server +sg_kibana_server: + readonly: true + cluster: + - CLUSTER_MONITOR + - CLUSTER_COMPOSITE_OPS + - cluster:admin/xpack/monitoring* + - indices:admin/template* + - indices:data/read/scroll* + indices: + '?kibana': + '*': + - INDICES_ALL + '?kibana-6': + '*': + - INDICES_ALL + '?kibana_*': + '*': + - INDICES_ALL + '?reporting*': + '*': + - INDICES_ALL + '?monitoring*': + '*': + - INDICES_ALL + '?tasks': + '*': + - INDICES_ALL + '?management-beats*': + '*': + - INDICES_ALL + '*': + '*': + - "indices:admin/aliases*" + +# For logstash and beats +sg_logstash: + cluster: + - CLUSTER_MONITOR + - CLUSTER_COMPOSITE_OPS + - indices:admin/template/get + - indices:admin/template/put + indices: + 'logstash-*': + '*': + - CRUD + - CREATE_INDEX + '*beat*': + '*': + - CRUD + - CREATE_INDEX + +# Allows adding and modifying repositories and creating and restoring snapshots +sg_manage_snapshots: + cluster: + - MANAGE_SNAPSHOTS + indices: + '*': + '*': + - "indices:data/write/index" + - "indices:admin/create" + +# Allows each user to access own named index +sg_own_index: + cluster: + - CLUSTER_COMPOSITE_OPS + indices: + '${user_name}': + '*': + - INDICES_ALL + +### X-Pack COMPATIBILITY +sg_xp_monitoring: + readonly: true + cluster: + - cluster:monitor/xpack/info + - cluster:monitor/main + - cluster:admin/xpack/monitoring/bulk + indices: + '?monitor*': + '*': + - INDICES_ALL + +sg_xp_alerting: + readonly: true + cluster: + - indices:data/read/scroll + - cluster:admin/xpack/watcher* + - cluster:monitor/xpack/watcher* + indices: + '?watches*': + '*': + - INDICES_ALL + '?watcher-history-*': + '*': + - INDICES_ALL + '?triggered_watches': + '*': + - INDICES_ALL + '*': + '*': + - READ + - indices:admin/aliases/get + +sg_xp_machine_learning: + readonly: true + cluster: + - cluster:admin/persistent* + - cluster:internal/xpack/ml* + - indices:data/read/scroll* + - cluster:admin/xpack/ml* + - cluster:monitor/xpack/ml* + indices: + '*': + '*': + - READ + - indices:admin/get* + '?ml-*': + '*': + - "*" + +### LEGACY ROLES, FOR COMPATIBILITY ONLY +### WILL BE REMOVED IN SG7, DO NOT USE ANYMORE + +sg_readonly_and_monitor: + cluster: + - CLUSTER_MONITOR + - CLUSTER_COMPOSITE_OPS_RO + indices: + '*': + '*': + - READ + +# Make xpack monitoring work +sg_monitor: + cluster: + - cluster:admin/xpack/monitoring/* + - cluster:admin/ingest/pipeline/put + - cluster:admin/ingest/pipeline/get + - indices:admin/template/get + - indices:admin/template/put + - CLUSTER_MONITOR + - CLUSTER_COMPOSITE_OPS + indices: + '?monitor*': + '*': + - INDICES_ALL + '?marvel*': + '*': + - INDICES_ALL + '?kibana*': + '*': + - READ + '*': + '*': + - indices:data/read/field_caps + +# Make xpack alerting work +sg_alerting: + cluster: + - indices:data/read/scroll + - cluster:admin/xpack/watcher/watch/put + - cluster:admin/xpack/watcher* + - CLUSTER_MONITOR + - CLUSTER_COMPOSITE_OPS + indices: + '?kibana*': + '*': + - READ + '?watches*': + '*': + - INDICES_ALL + '?watcher-history-*': + '*': + - INDICES_ALL + '?triggered_watches': + '*': + - INDICES_ALL + '*': + '*': + - READ + + +sg_role_test: + cluster: + - indices:admin/template/get + - indices:admin/template/put + - CLUSTER_COMPOSITE_OPS + indices: + '*': + '*': + - UNLIMITED diff --git a/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_roles_mapping.yml b/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_roles_mapping.yml new file mode 100644 index 0000000000..970e02763b --- /dev/null +++ b/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_roles_mapping.yml @@ -0,0 +1,38 @@ +# In this file users, backendroles and hosts can be mapped to Search Guard roles. +# Permissions for Search Guard roles are configured in sg_roles.yml + +sg_all_access: + readonly: true + backendroles: + - admin + +sg_logstash: + backendroles: + - logstash + +sg_kibana_server: + readonly: true + users: + - kibanaserver + +sg_kibana_user: + backendroles: + - kibanauser + +sg_readall: + readonly: true + backendroles: + - readall + +sg_manage_snapshots: + readonly: true + backendroles: + - snapshotrestore + +sg_own_index: + users: + - '*' + +sg_role_test: + users: + - test -- cgit 1.2.3-korg