Additional validation for elasticsearch username #48247

jportner · 2019-10-15T16:15:22Z

Summary

If "elastic" user is set in config:

In dev mode, throws an error
In prod mode, logs a deprecation warning

Resolves: #45973

"Release Note: Deprecated the use of the 'elastic' superuser for Kibana."

Checklist

Use ~~strikethroughs~~ to remove checklist items you don't feel are applicable to this PR.

~~[ ] This was checked for cross-browser compatibility, including a check against IE11~~
Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
~~[ ] Documentation was added for features that require explanation or tutorials~~
Unit or functional tests were updated or added to match the most common scenarios
~~[ ] This was checked for keyboard-only and screenreader accessibility~~

For maintainers

This includes a feature addition or change that requires a release note and was labeled appropriately
This was checked for breaking API changes and was labeled appropriately

elasticmachine · 2019-10-15T16:17:00Z

Pinging @elastic/kibana-security (Team:Security)

jportner · 2019-10-15T16:23:25Z

src/core/server/elasticsearch/elasticsearch_config.ts

@@ -160,7 +177,7 @@ export class ElasticsearchConfig {
   */
  public readonly customHeaders: ElasticsearchConfigType['customHeaders'];

-  constructor(rawConfig: ElasticsearchConfigType) {
+  constructor(rawConfig: ElasticsearchConfigType, log?: Logger) {


Since passing the logger to this constructor is temporary (shouldn't be needed when #40255 is resolved), I left the param as optional -- to avoid TypeScript errors in test files and to avoid changing those files.

jportner · 2019-10-15T16:34:28Z

Note: as discussed with @legrego, this change also affects OSS users -- even though OSS has no concept of the "superuser" (paraphrasing here). We couldn't think of any way to add this validation without any impact to OSS users though.

elasticmachine · 2019-10-15T17:39:25Z

💔 Build Failed

continuous-integration/kibana-ci/pull-request
Commit: b9768b9

elasticmachine · 2019-10-15T20:21:11Z

💔 Build Failed

continuous-integration/kibana-ci/pull-request
Commit: 2d8ebdf

elasticmachine · 2019-10-15T20:43:23Z

💔 Build Failed

continuous-integration/kibana-ci/pull-request
Commit: 577e29a

elasticmachine · 2019-10-16T17:12:08Z

💔 Build Failed

continuous-integration/kibana-ci/pull-request
Commit: 509f44a

elasticmachine · 2019-10-16T21:14:19Z

💔 Build Failed

continuous-integration/kibana-ci/pull-request
Commit: 183781f

jportner · 2019-10-17T14:08:10Z

Spoke to @azasypkin and @jkakavas about this--
The last functional test for SAML IdP-initiated single-logout is failing due to a bug in ElasticSearch (elastic/elasticsearch#47151).
This was not surfacing in Kibana tests before because the tests were running with the "elastic" superuser.

jportner · 2019-10-24T15:31:15Z

@elasticmachine merge upstream

elasticmachine · 2019-10-24T16:50:37Z

💔 Build Failed

continuous-integration/kibana-ci/pull-request
Commit: fa84842

elasticmachine · 2019-11-01T22:36:34Z

💔 Build Failed

continuous-integration/kibana-ci/pull-request
Commit: 947ac8b

elasticmachine · 2019-11-13T22:17:26Z

💔 Build Failed

continuous-integration/kibana-ci/pull-request
Commit: 9dc0949

elasticmachine · 2019-11-14T01:53:14Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request
Commit: 58d3358

kobelb · 2019-11-14T16:42:17Z

This is awesome, nicework! Just one nit, and a question/suggestion.

src/core/server/elasticsearch/elasticsearch_config.ts

elasticmachine · 2019-11-15T16:29:16Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request
Commit: 1664a13

If "elastic" user is set in config: * In dev mode, throws an error * In prod mode, logs a deprecation warning

Revert "Fix user for functional tests" and "Fix user for plugin functional tests in Jenkinsfile"

Now uses "kibana" user instead of "elastic" user

elasticmachine · 2019-11-18T15:17:58Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request
Commit: c6daad1

* Additional validation for elasticsearch username If "elastic" user is set in config: * In dev mode, throws an error * In prod mode, logs a deprecation warning * Fix user for functional tests * Revert last two commits Revert "Fix user for functional tests" and "Fix user for plugin functional tests in Jenkinsfile" * Change elasticsearch creds for test server Now uses "kibana" user instead of "elastic" user * Fix plugin API functional tests * Fix PKI API integration test * Change log messages, now conditional on `dist: false` not `dev: true`

…-fallback * 'master' of github.com:elastic/kibana: (116 commits) [Maps] move apply global filter settting from layer to source (elastic#50523) [SIEM] Fix: Empty `Source` / `Destination` shown when only ports are populated (elastic#50843) [Maps] Delay vector tile layer syncing until spritesheet is loaded (elastic#48955) [Maps] prevent users from overflowing URL when filtering by shape (elastic#50747) [DOCS] Mark Beats central management as discontinued (elastic#49423) [page_objects/common_page] convert to ts (elastic#50771) [NP Kibana Migrations ] kibana plugin home (elastic#50444) [DOCS] Shareables naming convention (elastic#50497) [ML] DF Analytics - auto-populate model_memory_limit (elastic#50714) Increase alerting test stability and reduce flakiness (elastic#50246) [ML] Remaning new_job_new folder (elastic#50917) [Telemetry] Show opt-in changes for OSS users (elastic#50831) [ML] Fix lat_long anomalies table links menu and value formatting (elastic#50916) [Dev] Fix serialising a really big string (elastic#50915) Better explanation about the Prettier recommendation (extension vs. NPM module) (elastic#50629) [Monitoring] Use a basic monitoring user for tests (elastic#47865) [Monitoring] Gracefully handle issue with filebeat indices (elastic#48929) [Monitoring] Improve permissions required around setup mode (elastic#50421) Additional validation for elasticsearch username (elastic#48247) Revert changes to use_kibana_ui_setting (elastic#50877) ... # Conflicts: # src/legacy/core_plugins/console/server/request.test.ts

jportner added release_note:deprecation Team:Security Team focused on: Auth, Users, Roles, Spaces, Audit Logging, and more! v7.5.0 v8.0.0 labels Oct 15, 2019

jportner commented Oct 15, 2019

View reviewed changes

jportner force-pushed the issue-45973-prohibit-kibana-superuser branch from fa84842 to 947ac8b Compare November 1, 2019 21:12

jportner force-pushed the issue-45973-prohibit-kibana-superuser branch from 947ac8b to 9dc0949 Compare November 13, 2019 20:56

jportner force-pushed the issue-45973-prohibit-kibana-superuser branch from 9dc0949 to 58d3358 Compare November 14, 2019 00:36

jportner marked this pull request as ready for review November 14, 2019 15:35

jportner requested a review from a team as a code owner November 14, 2019 15:35

jportner requested a review from a team November 14, 2019 15:36

kobelb self-requested a review November 14, 2019 15:40

kobelb reviewed Nov 14, 2019

View reviewed changes

src/core/server/elasticsearch/elasticsearch_config.ts Outdated Show resolved Hide resolved

src/core/server/elasticsearch/elasticsearch_config.ts Outdated Show resolved Hide resolved

azasypkin reviewed Nov 14, 2019

View reviewed changes

src/core/server/elasticsearch/elasticsearch_config.ts Outdated Show resolved Hide resolved

jportner force-pushed the issue-45973-prohibit-kibana-superuser branch from 58d3358 to 1664a13 Compare November 15, 2019 15:12

kobelb approved these changes Nov 15, 2019

View reviewed changes

jportner added v7.6.0 and removed v7.5.0 labels Nov 15, 2019

pgayvallet approved these changes Nov 15, 2019

View reviewed changes

jportner added 7 commits November 18, 2019 08:57

Additional validation for elasticsearch username

9258a58

If "elastic" user is set in config: * In dev mode, throws an error * In prod mode, logs a deprecation warning

Fix user for functional tests

33755f5

Revert last two commits

ef278fe

Revert "Fix user for functional tests" and "Fix user for plugin functional tests in Jenkinsfile"

Change elasticsearch creds for test server

2b7432f

Now uses "kibana" user instead of "elastic" user

Fix plugin API functional tests

28325f1

Fix PKI API integration test

d218f9c

Change log messages, now conditional on dist: false not dev: true

c6daad1

jportner force-pushed the issue-45973-prohibit-kibana-superuser branch from 1664a13 to c6daad1 Compare November 18, 2019 13:58

jportner merged commit bde2895 into elastic:master Nov 18, 2019

jportner mentioned this pull request Nov 18, 2019

[7.x] Additional validation for elasticsearch username (#48247) #50920

Merged

jportner deleted the issue-45973-prohibit-kibana-superuser branch November 18, 2019 16:51

kobelb mentioned this pull request Nov 19, 2019

[Breaking change] forbid elasticsearch.username: elastic in production #51101

Closed

kobelb mentioned this pull request Dec 2, 2019

Disable elastic user in development #52036

Open

jportner mentioned this pull request Jan 16, 2020

Update Monitoring plugin's Elasticsearch configuration #55119

Merged

This was referenced Aug 31, 2021

Security usage data #110532

Closed

Security usage data #110548

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Additional validation for elasticsearch username #48247

Additional validation for elasticsearch username #48247

jportner commented Oct 15, 2019 •

edited

Loading

elasticmachine commented Oct 15, 2019

jportner Oct 15, 2019

jportner commented Oct 15, 2019

elasticmachine commented Oct 15, 2019

elasticmachine commented Oct 15, 2019

elasticmachine commented Oct 15, 2019

elasticmachine commented Oct 16, 2019

elasticmachine commented Oct 16, 2019

jportner commented Oct 17, 2019

jportner commented Oct 24, 2019

elasticmachine commented Oct 24, 2019

elasticmachine commented Nov 1, 2019

elasticmachine commented Nov 13, 2019

elasticmachine commented Nov 14, 2019

kobelb commented Nov 14, 2019

elasticmachine commented Nov 15, 2019

elasticmachine commented Nov 18, 2019

Additional validation for elasticsearch username #48247

Additional validation for elasticsearch username #48247

Conversation

jportner commented Oct 15, 2019 • edited Loading

Summary

Checklist

For maintainers

elasticmachine commented Oct 15, 2019

jportner Oct 15, 2019

Choose a reason for hiding this comment

jportner commented Oct 15, 2019

elasticmachine commented Oct 15, 2019

💔 Build Failed

elasticmachine commented Oct 15, 2019

💔 Build Failed

elasticmachine commented Oct 15, 2019

💔 Build Failed

elasticmachine commented Oct 16, 2019

💔 Build Failed

elasticmachine commented Oct 16, 2019

💔 Build Failed

jportner commented Oct 17, 2019

jportner commented Oct 24, 2019

elasticmachine commented Oct 24, 2019

💔 Build Failed

elasticmachine commented Nov 1, 2019

💔 Build Failed

elasticmachine commented Nov 13, 2019

💔 Build Failed

elasticmachine commented Nov 14, 2019

💚 Build Succeeded

kobelb commented Nov 14, 2019

elasticmachine commented Nov 15, 2019

💚 Build Succeeded

elasticmachine commented Nov 18, 2019

💚 Build Succeeded

jportner commented Oct 15, 2019 •

edited

Loading