{"id":304,"date":"2020-01-23T16:23:46","date_gmt":"2020-01-23T16:23:46","guid":{"rendered":"https:\/\/www.samarthya.me\/wps\/?p=304"},"modified":"2020-01-23T16:23:46","modified_gmt":"2020-01-23T16:23:46","slug":"securing-elastic","status":"publish","type":"post","link":"https:\/\/blog.samarthya.me\/wps\/2020\/01\/23\/securing-elastic\/","title":{"rendered":"Securing Elastic"},"content":{"rendered":"\n<p>Security is integral to every and all the tasks in a shared environment. In ELK if you have setup a cluster which is accessible to all; anyone can make modifications which may or may not impact the other users.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p><a href=\"https:\/\/www.elastic.co\/guide\/en\/elasticsearch\/reference\/7.5\/security-privileges.html\">Security Privileges (XPACK)<\/a><\/p><\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\">Elastic cluster<\/h2>\n\n\n\n<p>The nodes that form the cluster, Kibana instances, Beats agents and clients all together form a cluster.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why secure it?<\/h2>\n\n\n\n<p>In basic licensing (default), elastic comes with minimal security and it is accessible to all who know the URL or the machine location. To prevent this unauthorized access to your elastic cluster you need to authenticate user.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>The Elasticsearch security features enable you to authorize users, assign access privileges to roles, and assign those roles to users.<\/p><\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\">Useful links<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/www.elastic.co\/guide\/en\/elasticsearch\/reference\/current\/setup-passwords.html\">https:\/\/www.elastic.co\/guide\/en\/elasticsearch\/reference\/current\/setup-passwords.html<\/a> <\/li><li><a href=\"https:\/\/www.elastic.co\/guide\/en\/elasticsearch\/reference\/7.5\/security-privileges.html\">https:\/\/www.elastic.co\/guide\/en\/elasticsearch\/reference\/7.5\/security-privileges.html<\/a><\/li><li><a href=\"https:\/\/www.elastic.co\/guide\/en\/elasticsearch\/reference\/7.5\/built-in-users.html\">https:\/\/www.elastic.co\/guide\/en\/elasticsearch\/reference\/7.5\/built-in-users.html<\/a><\/li><li><a href=\"https:\/\/www.elastic.co\/guide\/en\/elasticsearch\/reference\/7.5\/built-in-users.html#bootstrap-elastic-passwords\">https:\/\/www.elastic.co\/guide\/en\/elasticsearch\/reference\/7.5\/built-in-users.html#bootstrap-elastic-passwords<\/a><\/li><li><a href=\"https:\/\/www.elastic.co\/guide\/en\/elasticsearch\/reference\/current\/security-api.html\">https:\/\/www.elastic.co\/guide\/en\/elasticsearch\/reference\/current\/security-api.html<\/a><\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Securing the cluster<\/h2>\n\n\n\n<p>Elasticsearch uses TLS to perform encryption of the messages and the authentication of different nodes.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">TLS for communication<\/h3>\n\n\n\n<p>You can generate your own certificates using a tool called <code>elasticsearch-certutil<\/code> which takes care of generating a CA and signing certificate with it.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Example Cluster<\/h2>\n\n\n\n<pre class=\"wp-block-preformatted\">GET _cluster\/health\n\n\n{\n   \"cluster_name\" : \"saurabh\",\n   \"status\" : \"green\",\n   \"timed_out\" : false,\n   \"number_of_nodes\" : 3,\n   \"number_of_data_nodes\" : 3,\n   \"active_primary_shards\" : 7,\n   \"active_shards\" : 14,\n   \"relocating_shards\" : 0,\n   \"initializing_shards\" : 0,\n   \"unassigned_shards\" : 0,\n   \"delayed_unassigned_shards\" : 0,\n   \"number_of_pending_tasks\" : 0,\n   \"number_of_in_flight_fetch\" : 0,\n   \"task_max_waiting_in_queue_millis\" : 0,\n   \"active_shards_percent_as_number\" : 100.0\n }<\/pre>\n\n\n\n<p><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">RBAC : Role-Based Access Control<\/h2>\n\n\n\n<p>Using roles and users you can enable security in elastic cluster.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Terms<\/h3>\n\n\n\n<pre class=\"wp-block-preformatted\">User: Authenticated user\nRole: Named set of permissions\nPermission: Set of one or more privileges against the secured resource. E.g. read, delete, manage\nPrivilege: Named group of one or more actions that a user may execute.\nSecured resource: A limited access resource. E.g Indices, Aliases, documents, fields, users and the cluster itself.<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Security APIs<\/h2>\n\n\n\n<p>Elastic offers security (dedicated) api&#8217;s to <\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Authenticate <\/li><li>Clear Cache <\/li><li>Delegate PKI authentication <\/li><li>Privileges check <\/li><li>SSL certificate<\/li><\/ul>\n\n\n\n<p>More details available <a href=\"https:\/\/www.elastic.co\/guide\/en\/elasticsearch\/reference\/current\/security-api.html\">here<\/a>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">API &#8211; Example<\/h3>\n\n\n\n<p>To create a user via API simply use<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">POST _security\/user\/test\n {\n   \"password\" : \"testpassword\",\n   \"roles\" : [ \"kibana_dashboard_only_user\"],\n   \"full_name\" : \"API User\",\n   \"email\" : \"test@test.com\",\n   \"metadata\" : {\n     \"hometown\" : \"Springfield\",\n     \"age\": 40,\n     \"description\": \"stop at nothing.\"\n   }\n }<\/pre>\n\n\n\n<p>Returns<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">{\n   \"created\" : true\n }<\/pre>\n\n\n\n<p>To check the details of the created user<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">GET _security\/user\/test<\/pre>\n\n\n\n<p>It should return the details we furnished while creating it.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">{\n   \"test\" : {\n     \"username\" : \"test\",\n     \"roles\" : [\n       \"kibana_dashboard_only_user\"\n     ],\n     \"full_name\" : \"API User\",\n     \"email\" : \"test@test.com\",\n     \"metadata\" : {\n       \"hometown\" : \"Springfield\",\n       \"description\" : \"stop at nothing.\",\n       \"age\" : 40\n     },\n     \"enabled\" : true\n   }\n }<\/pre>\n\n\n\n<p>When done deleting this user is as simple as issuing a command<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">DELETE _security\/user\/test<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Realms<\/h2>\n\n\n\n<p>Authentication in the Elastic Stack security features is handled by one or more authentication services called <em><code>realms<\/code><\/em>. A <em><code>realm<\/code><\/em> is used to resolve and authenticate users based on authentication tokens. <\/p>\n\n\n\n<p>Realms can be roughly two categories Internal &amp; External.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Internal<\/h3>\n\n\n\n<p>Requires no communication with external parties, completely internal to Elasticsearch. There can be maximum one configured internal realm type.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">E.g. NATIVE and FILE<\/pre>\n\n\n\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container is-layout-flow wp-block-group-is-layout-flow\">\n<h2 class=\"wp-block-heading\">Index .security <\/h2>\n\n\n\n<p>Built in users are stored in <code>.security<\/code> index (inside Native realm; details above). These users (mentioned below) have fixed set of roles, and their passwords needs to be setup before they can be used. This index is internally maintained by Elasticsearch.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>The changes to any user (disabled, password change) are reflected across cluster automatically<\/p><\/blockquote>\n\n\n\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container is-layout-flow wp-block-group-is-layout-flow\">\n<figure class=\"wp-block-image size-large\"><img fetchpriority=\"high\" decoding=\"async\" width=\"455\" height=\"319\" src=\"https:\/\/www.samarthya.me\/wps\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-23-at-4.18.26-PM-2.png\" alt=\"\" class=\"wp-image-315\" srcset=\"https:\/\/blog.samarthya.me\/wps\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-23-at-4.18.26-PM-2.png 455w, https:\/\/blog.samarthya.me\/wps\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-23-at-4.18.26-PM-2-300x210.png 300w\" sizes=\"(max-width: 455px) 100vw, 455px\" \/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Basic details<\/h3>\n\n\n\n<p><code><strong>elastic<\/strong><\/code> A built-in <em>superuser<\/em>. See <a href=\"https:\/\/www.elastic.co\/guide\/en\/elasticsearch\/reference\/7.5\/built-in-roles.html\">Built-in roles<\/a>. <\/p>\n\n\n\n<p><code><strong>kibana<\/strong><\/code> The user Kibana uses to connect and communicate with Elasticsearch. <\/p>\n\n\n\n<p><code><strong>logstash_system<\/strong><\/code> The user Logstash uses when storing monitoring information in Elasticsearch. <\/p>\n\n\n\n<p><code><strong>beats_system<\/strong><\/code> The user the Beats use when storing monitoring information in Elasticsearch. <\/p>\n\n\n\n<p><code><strong>apm_system<\/strong><\/code> The user the APM server uses when storing monitoring information in Elasticsearch. <\/p>\n\n\n\n<p><code><strong>remote_monitoring_user<\/strong><\/code> The user Metricbeat uses when collecting and storing monitoring information in Elasticsearch. It has the <code><strong>remote_monitoring_agent<\/strong><\/code> and <code><strong>remote_monitoring_collector<\/strong><\/code> built-in roles. <\/p>\n<\/div><\/div>\n\n\n\n<h3 class=\"wp-block-heading\">User &#8211; elastic<\/h3>\n\n\n\n<p>This is the default superuser and have full access to cluster. Avoid using it for regular operations; create a user for daily use.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Roles<\/h3>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"566\" height=\"657\" src=\"https:\/\/www.samarthya.me\/wps\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-23-at-4.16.43-PM.png\" alt=\"\" class=\"wp-image-310\" srcset=\"https:\/\/blog.samarthya.me\/wps\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-23-at-4.16.43-PM.png 566w, https:\/\/blog.samarthya.me\/wps\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-23-at-4.16.43-PM-258x300.png 258w, https:\/\/blog.samarthya.me\/wps\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-23-at-4.16.43-PM-300x348.png 300w\" sizes=\"(max-width: 566px) 100vw, 566px\" \/><\/figure>\n<\/div><\/div>\n\n\n\n<h3 class=\"wp-block-heading\">External<\/h3>\n\n\n\n<p>Realms that require external (third party) interaction. There can be as many external realms as required.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">E.g. saml, kerberos, pki etc.<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\"><a href=\"https:\/\/www.elastic.co\/guide\/en\/elasticsearch\/reference\/7.5\/native-realm.html\">Native Realm<\/a><\/h4>\n\n\n\n<p>The default basic authentication &#8211; realm where the users are stored inside a dedicated index (<code>.security<\/code>). You can use the REST APIs or Kibana to add and remove users, assign user roles, and manage user passwords. The realm configurations are all done in <code>elastic.yml<\/code><\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Other Realms<\/h4>\n\n\n\n<pre class=\"wp-block-preformatted\">ldap\nactive_directory\npki\nfile\nsaml\nkerberos\noidc<\/pre>\n\n\n\n<h2 class=\"has-text-align-center wp-block-heading\">&#8212; THE &#8211; END &#8212; <\/h2>\n","protected":false},"excerpt":{"rendered":"<p>Security is integral to every and all the tasks in a shared environment. In ELK if you have setup a cluster which is accessible to all; anyone can make modifications which may or may not impact the other users. Security Privileges (XPACK) Elastic cluster The nodes that form the cluster, Kibana instances, Beats agents and [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":321,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"footnotes":""},"categories":[1,34],"tags":[32,16],"class_list":["post-304","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-others","category-technical","tag-elastic","tag-security"],"_links":{"self":[{"href":"https:\/\/blog.samarthya.me\/wps\/wp-json\/wp\/v2\/posts\/304","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.samarthya.me\/wps\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.samarthya.me\/wps\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.samarthya.me\/wps\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.samarthya.me\/wps\/wp-json\/wp\/v2\/comments?post=304"}],"version-history":[{"count":0,"href":"https:\/\/blog.samarthya.me\/wps\/wp-json\/wp\/v2\/posts\/304\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.samarthya.me\/wps\/wp-json\/wp\/v2\/media\/321"}],"wp:attachment":[{"href":"https:\/\/blog.samarthya.me\/wps\/wp-json\/wp\/v2\/media?parent=304"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.samarthya.me\/wps\/wp-json\/wp\/v2\/categories?post=304"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.samarthya.me\/wps\/wp-json\/wp\/v2\/tags?post=304"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}