Skip to content

Document privileges for running Beats features against secured cluster#7128

Merged
andrewkroh merged 6 commits intoelastic:masterfrom
dedemorton:security_changes
Jun 9, 2018
Merged

Document privileges for running Beats features against secured cluster#7128
andrewkroh merged 6 commits intoelastic:masterfrom
dedemorton:security_changes

Conversation

@dedemorton
Copy link
Copy Markdown
Contributor

@dedemorton dedemorton commented May 18, 2018 •
edited
Loading

Fixes #4826.

Note that this is a quick fix for 6.3. Ideally, we should not be documenting how to create a role; we should point off to the security docs for that. However, our stack-level security docs need more work, so I'm making fixes to the existing content (rather than rewriting) for 6.3. We also need to consider adding more beats-specific built-in roles.

TODO:

  • I need to update the topic about loading dashboards to show how to load dashboards when the output is Logstash and security is enabled. Because beats needs to communicate with ES, the user needs to temporarily enable ES:
setup -e \
  -E output.logstash.enabled=false \
  -E output.elasticsearch.hosts=['localhost:9200'] \
  -E output.elasticsearch.username="filebeat_internal" \
  -E output.elasticsearch.password="test-password" \
  -E setup.kibana.host=localhost:5601

UPDATE: I've added the built docs (Filebeat) to firebase to make it easier for you to review them: https://filebeatsecurityupdates.firebaseapp.com/securing-beats.html

@dedemorton dedemorton added review needs_backport PR is waiting to be backported to other branches. labels May 18, 2018
@dedemorton dedemorton requested a review from andrewkroh May 18, 2018 01:58
@dedemorton
Copy link
Copy Markdown
Contributor Author

dedemorton commented May 18, 2018

@andrewkroh I've added instructions for loading the dashboards when LS output is enabled (we talked about that a couple weeks ago). There are some bits I'm not sure about, so I've added questions for reviewers. We might be able to simplify the command, but I thought I'd start with all the things and see what you think.

@dedemorton dedemorton requested a review from karenzone May 21, 2018 19:13
@dedemorton
Copy link
Copy Markdown
Contributor Author

dedemorton commented May 30, 2018 •
edited
Loading

Removed my link because it pointed to an internal document.

karenzone
karenzone reviewed May 30, 2018
View reviewed changes
Copy link
Copy Markdown
Contributor

@karenzone karenzone left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Started, but not finished. There's a lot going on here. Looks like it's heading in a good direction

andrewkroh
andrewkroh reviewed May 31, 2018
View reviewed changes
libbeat/docs/dashboards.asciidoc Outdated
Copy link
Copy Markdown
Member

@andrewkroh andrewkroh May 31, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should be {beat_default_index_prefix}_internal. There are a few instances of this.

libbeat/docs/dashboards.asciidoc Outdated
Copy link
Copy Markdown
Member

@andrewkroh andrewkroh May 31, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We don't need set it in this case. I think it only needs to be used when loading the dashboards (setup --dashboards) and a connection to ES is not possible (so it will skip the ES version check).

libbeat/docs/dashboards.asciidoc Outdated
Copy link
Copy Markdown
Member

@andrewkroh andrewkroh May 31, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We can remove the conditional for auditbeat. It is used with docker quite a bit now.

libbeat/docs/security/basic-auth.asciidoc Outdated
Copy link
Copy Markdown
Member

@andrewkroh andrewkroh May 31, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

kibana_user seems ok. I'm not sure what privileges could be removed.

BTW If the user does not have privileges to .kibana there are no errors anywhere that I can see. But none of the dashboards or the index pattern get installed. Sounds like a bug in ES or Kibana that it does not respond with a 403.

Copy link
Copy Markdown
Contributor Author

@dedemorton dedemorton Jun 4, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@andrewkroh Do I need to open an issue for this, or do you plan to follow up?

libbeat/docs/dashboards.asciidoc Outdated
Copy link
Copy Markdown
Member

@andrewkroh andrewkroh May 31, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍 Tested it on win2012.

andrewkroh
andrewkroh reviewed May 31, 2018
View reviewed changes
libbeat/docs/security/securing-beats.asciidoc Outdated
Copy link
Copy Markdown
Member

@andrewkroh andrewkroh May 31, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would keep ML. At the moment I think only Filebeat has them, but hopefully more Beats get ML configs soon.

@dedemorton dedemorton force-pushed the security_changes branch 2 times, most recently from 3be46bb to 540b300 Compare June 5, 2018 00:55
@dedemorton
Copy link
Copy Markdown
Contributor Author

dedemorton commented Jun 5, 2018

@andrewkroh I've updated the topics based on your feedback. Not sure if you've finished your first round of comments, tho. Let me know. There are still a few unanswered questions.

@dedemorton dedemorton force-pushed the security_changes branch 2 times, most recently from 7b31231 to 89b7c79 Compare June 8, 2018 19:30
@dedemorton
Copy link
Copy Markdown
Contributor Author

dedemorton commented Jun 8, 2018 •
edited by andrewkroh
Loading

Remaining review todo list:

You can preview the built docs here: https://filebeatsecurityupdates.firebaseapp.com/securing-beats.html

andrewkroh
andrewkroh reviewed Jun 8, 2018
View reviewed changes
libbeat/docs/security/basic-auth.asciidoc Outdated
{
"names": [ "{beat_default_index_prefix}-*" ], <1>
"privileges": ["write","create_index"]
"privileges": ["read","write","create_index"]
Copy link
Copy Markdown
Member

@andrewkroh andrewkroh Jun 8, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What is the read needed for? I can't think of any Beats that would use this. Packetbeat used to a long time ago, but not anymore AFAIK.

Copy link
Copy Markdown
Contributor Author

@dedemorton dedemorton Jun 8, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't have the reason in my notes. I'll retest to make sure it's not a copy/paste error.

Copy link
Copy Markdown
Contributor Author

@dedemorton dedemorton Jun 9, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Confirmed that "read" privilege is not required (tested on metricbeat and packetbeat...I'm assuming that's sufficient).

@dedemorton
Copy link
Copy Markdown
Contributor Author

dedemorton commented Jun 9, 2018

Assuming this passes CI tests, it should be ready to squash and merge.

@andrewkroh andrewkroh merged commit ae788a9 into elastic:master Jun 9, 2018
@dedemorton dedemorton deleted the security_changes branch June 12, 2018 21:38
dedemorton added a commit to dedemorton/beats that referenced this pull request Jun 12, 2018
@dedemorton
Document privileges for running Beats features against secured cluster (
cf7a427 
elastic#7128)

* Document privileges for running Beats features against secured cluster

* Add instructions for loading dashboards with LS output enabled

* Fix issues identified during review

* Remove reviewer notes

* Fix privileges on writer role

* Add link to security docs
@dedemorton dedemorton mentioned this pull request Jun 12, 2018
Merged
1 task
adriansr pushed a commit that referenced this pull request Jun 12, 2018
@dedemorton @adriansr
Document privileges for running Beats features against secured cluster (
d500c36 
#7128)

* Document privileges for running Beats features against secured cluster

* Add instructions for loading dashboards with LS output enabled

* Fix issues identified during review

* Remove reviewer notes

* Fix privileges on writer role

* Add link to security docs
@dedemorton dedemorton removed the needs_backport PR is waiting to be backported to other branches. label Jun 18, 2018
@lcawl lcawl mentioned this pull request Jan 11, 2019
Merged
leweafan pushed a commit to leweafan/beats that referenced this pull request Apr 28, 2023
@dedemorton @adriansr
Document privileges for running Beats features against secured cluster (
f0f0cf8 
elastic#7128)

* Document privileges for running Beats features against secured cluster

* Add instructions for loading dashboards with LS output enabled

* Fix issues identified during review

* Remove reviewer notes

* Fix privileges on writer role

* Add link to security docs
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@andrewkroh andrewkroh andrewkroh left review comments

+1 more reviewer

@karenzone karenzone karenzone left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

docs review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Beats users permissions for the default modules using ingest pipelines

3 participants

@dedemorton @andrewkroh @karenzone