Keystore: Allow user to set their own password on the keystore #5737
Comments
|
This was discussed in a call with @joshbressers @jakelandis @joshbressers Do we have more details about how ES is planning to do that? I just have found the meta issue. I am interested about your opinion @andrewkroh |
|
Looking through Logstash documentation: It should not be complicated to add support for user defined password via the environment, we already use an empty string as the password. We should probably follow the convention set by Logstash and use |
|
While it may not be completely avoidable, I'd prefer to keep secrets out of the environment as much as possible. I'd prefer reading from stdin where possible. This gives us more control over the memory where the secrets are stored. We can then do things to protect this memory and can wipe it when done. I think we should consider using the "ASKPASS" scheme followed by other tools like SSH and Git. Basically we would read from the terminal if we can or use the tool specified in With systemd we should use systemd-ask-password to collect the password. It will use the appropriate means to collect the input from the user and output it to our process. As we receive the password into memory we should consider adding some additional protections to the memory like ensuring that the password and any unencrypted secrets are not swapped to disk ( edit: And if the Beats needs a password we should get it early on because we want to add a seccomp filter that prevents |
|
I filed an issue for elasticsearch around needing a password to unlock the keystore |
urso
added
good first issue
andresrc
added
Team:Integrations
|
Hello, |
|
Hi! We're labeling this issue as |
|
👍 |
|
Hi! We're labeling this issue as |
This adds support a password protected keystore. The UX should match other stack products. Closes #21756. ``` [jon@mbpkbn1]/tmp/kibana-8.15.0-SNAPSHOT% bin/kibana-keystore create --password A Kibana keystore already exists. Overwrite? [y/N] y Enter new password for the kibana keystore (empty for no password): ******** Created Kibana keystore in /tmp/kibana-8.15.0-SNAPSHOT/config/kibana.keystore [jon@mbpkbn1]/tmp/kibana-8.15.0-SNAPSHOT% bin/kibana-keystore add elasticsearch.username Enter password for the kibana keystore: ******** Enter value for elasticsearch.username: ************* [jon@mbpkbn1]/tmp/kibana-8.15.0-SNAPSHOT% bin/kibana-keystore add elasticsearch.password Enter password for the kibana keystore: ******** Enter value for elasticsearch.password: ******** [jon@mbpkbn1]/tmp/kibana-8.15.0-SNAPSHOT% bin/kibana ... Enter password for the kibana keystore: ******** [2024-04-30T09:47:03.560-05:00][INFO ][root] Kibana is starting [jon@mbpkbn1]/tmp/kibana-8.15.0-SNAPSHOT% bin/kibana-keystore has-passwd Keystore is password-protected [jon@mbpkbn1]/tmp/kibana-8.15.0-SNAPSHOT% ./bin/kibana-keystore show elasticsearch.username Enter password for the kibana keystore: ******** kibana_system [jon@mbpkbn1]/tmp/kibana-8.15.0-SNAPSHOT% ./bin/kibana-keystore remove elasticsearch.username Enter password for the kibana keystore: ******** [jon@mbpkbn1]/tmp/kibana-8.15.0-SNAPSHOT% ./bin/kibana-keystore show elasticsearch.username Enter password for the kibana keystore: ******** ERROR: Kibana keystore doesn't have requested key. [jon@mbpkbn1]/tmp/kibana-8.15.0-SNAPSHOT% bin/kibana-keystore passwd Enter password for the kibana keystore: ******** Enter new password for the kibana keystore (empty for no password): [jon@mbpkbn1]/tmp/kibana-8.15.0-SNAPSHOT% ./bin/kibana-keystore has-passwd Error: Keystore is not password protected [jon@mbpkbn1]/tmp/kibana-8.15.0-SNAPSHOT% ./bin/kibana ... [2024-04-30T09:49:03.220-05:00][INFO ][root] Kibana is starting ``` ## Password input Environment variable usage is not consistent across stack products. I implemented `KBN_KEYSTORE_PASSWORD_FILE` and `KBN_KEYSTORE_PASSWORD` to be used to avoid prompts. @elastic/kibana-security do you have any thoughts? - `LOGSTASH_KEYSTORE_PASS` - https://www.elastic.co/guide/en/logstash/current/keystore.html#keystore-password - `KEYSTORE_PASSWORD` - https://www.elastic.co/guide/en/elasticsearch/reference/current/docker.html#docker-keystore-bind-mount - `ES_KEYSTORE_PASSPHRASE_FILE` - https://www.elastic.co/guide/en/elasticsearch/reference/current/rpm.html#rpm-running-systemd - Beats discussion, unresolved: elastic/beats#5737 ## Release note Adds password support to the Kibana keystore.
The current keystore currently uses a blank password "" and doesn't allow the user to configure the password on the keystore. The internal implementation has everything in place to support a user provided password.
Logstash is moving forward to allow user to setup an environment variable named
LOGSTASH_KEYSTORE_PASS, that could be use to decrypt and create new keys in the keystore.TODO
Follow up issue from #5687
related issues: elastic/elasticsearch#22475
The text was updated successfully, but these errors were encountered: