Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Security warning is not shown to user on Kibana for either basic or trial license for unsecured ES #86851

Closed
bhavyarm opened this issue Dec 22, 2020 · 7 comments
Assignees
Labels
bug Fixes for quality problems that affect the customer experience regression Team:Security Team focused on: Auth, Users, Roles, Spaces, Audit Logging, and more!

Comments

@bhavyarm
Copy link
Contributor

Kibana version: 7.11.0 BC1/latest snapshot

Elasticsearch version: 7.11.0BC1/latest snapshot

Server OS version: darwin_x86_64

Browser version: chrome latest

Browser OS version: OS X

Original install method (e.g. download page, yum, from source, etc.): from staging

Describe the bug: Security warning asking users to secure the cluster is not being shown in 7.11.0 on BC1/latest snapshot.
On both trial and basic license. It never showed up both on BC or snapshot.

Screenshots (if relevant):
Screen Shot 2020-12-22 at 5 40 52 PM

Errors in browser console (if relevant):
None

@bhavyarm bhavyarm added bug Fixes for quality problems that affect the customer experience regression Team:Security Team focused on: Auth, Users, Roles, Spaces, Audit Logging, and more! labels Dec 22, 2020
@elasticmachine
Copy link
Contributor

Pinging @elastic/kibana-security (Team:Security)

@bhavyarm bhavyarm changed the title Security warning is not shown to user on Kibana for either basic or trial license Security warning is not shown to user on Kibana for either basic or trial license for unsecured ES Dec 22, 2020
@jportner jportner self-assigned this Dec 23, 2020
@jportner
Copy link
Contributor

I tested the 7.11 branch and ran from source, I was able to trigger the notification both with OSS and X-pack.

OSS testing procedures:

  1. Ensure your kibana.yml does not have security.showInsecureClusterWarning disabled
  2. Clear your browser's local storage for your hostname (in case you previously dismissed the toast and checked "Do not show again")
  3. Start Elasticsearch in OSS mode: `yarn es snapshot --license=oss
  4. Start Kibana in OSS mode: yarn start --oss
  5. Log into Kibana and add some data in a test index
  6. Refresh the page and observe the toast message about securing your cluster

Default distribution testing procedures:

  1. Ensure your kibana.yml does not have security.showInsecureClusterWarning disabled
  2. Clear your browser's local storage for your hostname (in case you previously dismissed the toast and checked "Do not show again")
  3. Edit packages/kbn-es/src/install/archive.js and comment out the line that enables the Security plugin in Elasticsearch
  4. Re-bootstrap to rebuild the kbn-es package: yarn kbn bootstrap
  5. Start Elasticsearch: yarn es snapshot
  6. Start Kibana: yarn start
  7. Log into Kibana and add some data in a test index
  8. Refresh the page and observe the toast message about securing your cluster

We also have an integration test for the insecure cluster warning, which appears to be working.

I know you're running from staging, so for testing the default distribution you wouldn't need to take steps 3 and 4. Did you take all of the other steps above when you were testing this? Perhaps you needed to clear your browser's local storage?


To "add some data in a test index": any index that does not start with . or kibana_sample_ will work. I run this command in Kibana dev tools:

POST test/foo
{ "bar": "baz" }

@bhavyarm
Copy link
Contributor Author

bhavyarm commented Jan 4, 2021

@jportner I just tested it on fresh install of 7.11.0 snapshot after clearning my cache and warning is still not showing up. Can you please check on the snapshot? Thanks - https://snapshots.elastic.co/7.11.0-683a2a3c/summary-7.11.0-SNAPSHOT.html

@rashmivkulkarni
Copy link
Contributor

I confirm the same behavior on my local mac on 7.11.0 snapshot . Got the same builds as posted above and opened Kibana in incognito mode and warning is not showing up.

@rashmivkulkarni
Copy link
Contributor

Once having an index in the ES, the warning shows up immediately. This is the right behavior defined here: #78545

@bhavyarm
Copy link
Contributor Author

bhavyarm commented Jan 4, 2021

Thanks @rashmivkulkarni @legrego @jportner closing this one out!

@bhavyarm bhavyarm closed this as completed Jan 4, 2021
@LeeDr
Copy link

LeeDr commented Jan 4, 2021

The security dialog showed up on my install on Windows 2012 server of default distribution latest 7.11 snapshot (from Dec 22nd). It caused the logstash index pattern test to fail because the dialog is covering the Next button on the screen.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Fixes for quality problems that affect the customer experience regression Team:Security Team focused on: Auth, Users, Roles, Spaces, Audit Logging, and more!
Projects
None yet
Development

No branches or pull requests

5 participants