Improve Kibana account management and security

[mbudge]

Hi,

With the Elastic Stack moving more into the security space, the following needs to be improved

• Audit logs for user login/out, admin activities and changes, API access.
• Separate IP filtering for API and Kibana in Elastic Cloud (e.g. IP filter for API, none for Kibana).
• Better account management - password complexity rules and expiration in particular.
• Account lockout protection against brute-force attacks
• Kibana 2-Factor authentication Elastic Cloud

The audit logs are a requirement for any business which gets audited. It's common for auditors to ask for evidence of user login activity from random dates.

Thanks

[elasticmachine]

Pinging @elastic/kibana-security (Team:Security)

[legrego]

Hi @mbudge, thanks for opening this. I'll address your requests in order:

• Audit logs for user login/out, admin activities and changes, API access.

We've made a lot of improvements to Kibana audit logging in the upcoming 7.11 release:

• Docs: https://www.elastic.co/guide/en/kibana/master/xpack-security-audit-logging.html#xpack-security-ecs-audit-logging
• Issue showing our progress and planned next steps: [Meta] Audit Logging #52125

Separate IP filtering for API and Kibana in Elastic Cloud (e.g. IP filter for API, none for Kibana).

I can pass this request along to the Cloud team. This doesn't sound like something we can solve within Kibana itself.

Better account management - password complexity rules and expiration in particular.

This is being discussed in elastic/elasticsearch#29913

• Account lockout protection against brute-force attacks

This is being discussed in #18491. The summary of the conversation is that this would need to be solved in Elasticsearch if this is something we decide to do.

Kibana 2-Factor authentication Elastic Cloud

I'm not sure what resources are available to you, but if you were to authenticate via SAML or another SSO provider, then your provider could enable 2-Factor authentication (and password enforcement, lockout protection, etc) on your behalf.

We have a related issue around webauthn here: #39414

---

One of the reasons we don't have some of these features implemented yet, is that we've historically tried not to make Elasticsearch a full-fledged authentication/identity provider. We allow for basic user and account management via their native realm, but we've encouraged users needing more sophisticated setups to adopt an external identity provider.

That's not to say we won't ever do these things -- I'm just giving you some context to explain our current state.

[legrego]

In the interest of consolidating the discussion, I am going to close this in favor of the linked issues above. Thanks!