Autogenerate and print elastic pwd on startup #77291

jkakavas · 2021-09-05T20:50:37Z

Introduces functionality to generate and set a password for the
elastic user during the initialization of the Security plugin if

bootstrap.password is not already set in the keystore
the security index doesn't already exist
and the password for the elastic user is not yet set ( the doc
for the user doesn't exist in the security index )

This is printed in INFO level in the log, as we have already
wrapped System.out in Log4j and this is where stdout would be
printed either way. The password should not make it to the logs
and in a follow up we need to come up with a solution to this
problem.

Introduces functionality to generate and set a password for the elastic user during the initilization of the Security plugin if - `bootstrap.password` is not alredy set in the keystore - the security index doesn't already exist - and the password for the elastic user is not yet set ( the doc for the user doesn't exist in the security index ) This is printed in INFO level in the log, as we have already wrapped System.out in Log4j and this is where stdout would be printed either way. The password should not make it to the logs and in a follow up we need to come up with a solution to this problem.

elasticmachine · 2021-09-05T20:50:40Z

Pinging @elastic/es-security (Team:Security)

jkakavas · 2021-09-05T20:51:44Z

This is missing package tests, I plan to add some after/when we merge #77231, if we decide this is worth merging in its current format.

jkakavas · 2021-09-05T20:59:39Z

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/Security.java

+                    ElasticUser.NAME,
+                    elasticPassword.getChars(),
+                    ActionListener.wrap(
+                        r -> {


We could pass a reference to the original stdout PrintStream from Bootstrap to Node and then to the SecurityPlugin's createComponents so that we can temporarily call System.setOut to that , print to stdout and revert to log4j afterwards. This needs setIO RuntimePermission for the security plugin though and I'm not sure how comfortable I am with this change.

I don't understand why you'd need to call System.setOut - you just need a reference to the PrintStream so you can use it.

What we need is for Bootstrap (or something close to it) to hold on to the original stdout in a place that we can get to it (but is on the forbidden APIs list).

Bootstrap already has code to close original stream if we're not in the foreground, so I think a change to add a SystemConsole class in org.elasticsearch.bootstrap is entirely feasible.

Do you want me to pull something together?

I don't understand why you'd need to call System.setOut - you just need a reference to the PrintStream so you can use it.

Yes, you are right. I misunderstood how we do it ( and how handling stdout works most probably ) in LogConfigurator, and I had presumed the PrintStream would be unusable.

Do you want me to pull something together?

That would be great

tvernum · 2021-09-06T06:08:17Z

generate and set a password for the elastic user during the initialization of the Security plugin if

bootstrap.password is not already set in the keystore

the security index doesn't already exist

and the password for the elastic user is not yet set ( the doc for the user doesn't exist in the security index )

Do we intend, at a future time for there to be a setting that disables auto-configuration?

It feels like there might be use cases where a user wishes to not have a superuser password printed to the comsole, and we're currently saying the only way to achieve that is to set a bootstrap.password.
I think a way to opt-out of auto-security-configuration like this is reasonable.

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/Security.java

...security/src/main/java/org/elasticsearch/xpack/security/authc/esnative/NativeUsersStore.java

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/Security.java

jkakavas · 2021-09-06T06:44:33Z

generate and set a password for the elastic user during the initialization of the Security plugin if

bootstrap.password is not already set in the keystore

the security index doesn't already exist

and the password for the elastic user is not yet set ( the doc for the user doesn't exist in the security index )

Do we intend, at a future time for there to be a setting that disables auto-configuration?

It feels like there might be use cases where a user wishes to not have a superuser password printed to the comsole, and we're currently saying the only way to achieve that is to set a bootstrap.password.
I think a way to opt-out of auto-security-configuration like this is reasonable.

Yes, there is a relevant discussion in #77231 (comment). Even know we could do it with enrollment mode setting but I plan on adding the new setting in #77231

tvernum

I left a few comments, but I'm happy for you to merge when you and @BigPandaToo are happy.

.../main/java/org/elasticsearch/xpack/security/GenerateInitialBuiltinUsersPasswordListener.java

tvernum · 2021-09-07T00:27:00Z

.../main/java/org/elasticsearch/xpack/security/GenerateInitialBuiltinUsersPasswordListener.java

+
+            final SecureString elasticPassword = new SecureString(generatePassword(20));
+            final SecureString kibanaSystemPassword = new SecureString(generatePassword(20));
+            final GroupedActionListener<Void> changePasswordListener = new GroupedActionListener<>(


Why a GroupedActionListener when you're handling the sequencing yourself?

Yes, it was actually unnecessary. I think I just misread the docs and got an incorrect impression that I could fire off the two async actions, wait for both to complete and then do the outputting. Thinking through this again, I could probably do that with a CountDownLatch, but I don't think there is anything inherently wrong with sequencing the two calls and output to terminal in the onResponse of the second

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/Security.java

...security/src/main/java/org/elasticsearch/xpack/security/authc/esnative/NativeUsersStore.java

.../main/java/org/elasticsearch/xpack/security/GenerateInitialBuiltinUsersPasswordListener.java

BigPandaToo

LGTM

jkakavas · 2021-09-07T15:39:49Z

I'll wait for a few hours in case we can merge #77299 which we can take advantage of in order to print to stdout only ( not to logs ) which is the desired end goal for this change

rjernst · 2021-09-07T17:31:24Z

I'll wait for a few hours in case we can merge #77299

I left a suggestion in #77299 to use System.console() directly. I believe this will allow the desired behavior, to print only when in an interactive session, without needing any changes to the existing bootstrap code.

jkakavas · 2021-09-07T19:03:07Z

I left a suggestion in #77299 to use System.console() directly. I believe this will allow the desired behavior, to print only when in an interactive session, without needing any changes to the existing bootstrap code.

Sounds like a good idea. I'll give it a try here, do some manual testing and see if Packaging Tests are happy too.

UPDATE: Seems like System.console() returns null always ( #77299 (comment) ) not sure what causes that as this happens even early in Bootstrap code before we even touch standard out

jkakavas · 2021-09-07T20:38:10Z

I'll refrain from merging as-is for now just in case I am missing something obvious regarding #77291 (comment) and will revisit early in my morning in case there are any updates in #77299 and/or relevant discussion @tvernum @rjernst

rjernst · 2021-09-07T21:30:00Z

Seems like System.console() returns null always

What environment was ES running in when it returned null? It will only return non-null if attached to an actual console.

jkakavas · 2021-09-07T22:10:59Z

What environment was ES running in when it returned null? It will only return non-null if attached to an actual console.

Archive installation on Ubuntu 20.04 , bin/elasticsearch run in the terminal, so definitely attached to an actual console

tvernum · 2021-09-07T23:10:03Z

I've confirmed this is due to the way we pass the keystore password via stdin - it's no longer attached to a terminal, so the Console is null
More details here: #77299 (comment)

In elastic#77291, we introduced the functionality to auto-generate a password for the elastic user on startup. This means that the setup-passwords tool cannot be used ( as it depends on the password not being set ). This change fixes the QA project test cluster to start with auto-configuration disabled

In #77291, we introduced the functionality to auto-generate a password for the elastic user on startup. This means that the setup-passwords tool cannot be used ( as it depends on the password not being set ). This change fixes the QA project test cluster to start with auto-configuration disabled

jkakavas added 3 commits September 5, 2021 23:43

rename method

667baff

cleanup

1789a8e

jkakavas added >enhancement :Security/Authentication Logging in, Usernames/passwords, Realms (Native/LDAP/AD/SAML/PKI/etc) v8.0.0 labels Sep 5, 2021

jkakavas requested review from tvernum and BigPandaToo September 5, 2021 20:50

elasticmachine added the Team:Security Meta label for security team label Sep 5, 2021

jkakavas commented Sep 5, 2021

View reviewed changes

jkakavas mentioned this pull request Sep 5, 2021

Enroll additional nodes to cluster #77292

Merged

jkakavas added 2 commits September 6, 2021 01:21

Fix packaging test

3b47ec2

spotting less and less as time goes by

12867e4

tvernum reviewed Sep 6, 2021

View reviewed changes

jkakavas added 5 commits September 7, 2021 00:55

feedback

79a6c21

Handle Kibana password too

2b618db

add package tests

19ccb55

Reduce character set of autogenerated passwords

7a328b1

Merge remote-tracking branch 'origin/master' into print-elastic-password

6473ece

tvernum approved these changes Sep 7, 2021

View reviewed changes

jkakavas added 6 commits September 7, 2021 09:26

Create keystore before ES runs for the first time

8f40211

address feedback

a9c1b9e

wire async actions a little better

c653951

Merge remote-tracking branch 'origin/master' into print-elastic-password

fdfe14b

Fix username on output and adjust test stdout capturing

a63144b

disable autoconfiguration in tests, when not needed/used

7f08b9d

jkakavas added 3 commits September 7, 2021 12:08

Make test class archive specific ( Docker specific incoming )

f46f815

mute some more

1c2376c

not ready yet

3277e1a

jkakavas mentioned this pull request Sep 7, 2021

Setting elastic password from stored hash #77036

Closed

jkakavas added 3 commits September 7, 2021 16:05

disable auto-configuration for test clusters that don't need it

ccaac5a

more QA tests that don't need user autoconfiguration

6d0c9e4

_Actually_ mute on windows

db255ab

BigPandaToo approved these changes Sep 7, 2021

View reviewed changes

jkakavas merged commit 4250853 into elastic:master Sep 8, 2021

jkakavas mentioned this pull request Sep 8, 2021

[CI] SetupPasswordToolIT testSetupPasswordToolAutoSetup failing #77408

Closed

jkakavas mentioned this pull request Sep 8, 2021

Fix SetupPasswordToolIT #77413

Merged

astefan mentioned this pull request Sep 9, 2021

SQL: Skip automatically creating the "elastic" user #77507

Merged

jakelandis added v8.0.0-alpha2 and removed v8.0.0 labels Sep 15, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Autogenerate and print elastic pwd on startup #77291

Autogenerate and print elastic pwd on startup #77291

jkakavas commented Sep 5, 2021

elasticmachine commented Sep 5, 2021

jkakavas commented Sep 5, 2021

jkakavas Sep 5, 2021 •

edited

Loading

tvernum Sep 6, 2021

jkakavas Sep 6, 2021

tvernum commented Sep 6, 2021

jkakavas commented Sep 6, 2021

tvernum left a comment

tvernum Sep 7, 2021

jkakavas Sep 7, 2021

BigPandaToo left a comment

jkakavas commented Sep 7, 2021

rjernst commented Sep 7, 2021

jkakavas commented Sep 7, 2021 •

edited

Loading

jkakavas commented Sep 7, 2021

rjernst commented Sep 7, 2021

jkakavas commented Sep 7, 2021

tvernum commented Sep 7, 2021 •

edited

Loading

Autogenerate and print elastic pwd on startup #77291

Autogenerate and print elastic pwd on startup #77291

Conversation

jkakavas commented Sep 5, 2021

elasticmachine commented Sep 5, 2021

jkakavas commented Sep 5, 2021

jkakavas Sep 5, 2021 • edited Loading

Choose a reason for hiding this comment

tvernum Sep 6, 2021

Choose a reason for hiding this comment

jkakavas Sep 6, 2021

Choose a reason for hiding this comment

tvernum commented Sep 6, 2021

jkakavas commented Sep 6, 2021

tvernum left a comment

Choose a reason for hiding this comment

tvernum Sep 7, 2021

Choose a reason for hiding this comment

jkakavas Sep 7, 2021

Choose a reason for hiding this comment

BigPandaToo left a comment

Choose a reason for hiding this comment

jkakavas commented Sep 7, 2021

rjernst commented Sep 7, 2021

jkakavas commented Sep 7, 2021 • edited Loading

jkakavas commented Sep 7, 2021

rjernst commented Sep 7, 2021

jkakavas commented Sep 7, 2021

tvernum commented Sep 7, 2021 • edited Loading

jkakavas Sep 5, 2021 •

edited

Loading

jkakavas commented Sep 7, 2021 •

edited

Loading

tvernum commented Sep 7, 2021 •

edited

Loading