Do not generate an ephemeral encryption key in production. #81511

azasypkin · 2020-10-22T16:51:10Z

Currently we generate a random encryption key if it's not specified by default when Kibana is run in production setup (dist === true). After this PR we won't be automatically generating a random key in production in case it's not explicitly specified. We're also exposing canEncrypt property in the setup contract to help consumers figure out if ESO is able to perform encryption\decryption or not (instead of usingEphemeralEncryptionKey).

Note to reviewers: we initially planned to disable ESO plugin if encryption key isn't specified, but we later figured out that it can introduce non-trivial issues with Saved Objects migrations, so we decided not to do that for now.

Fixes: #79943

Release note

Previously Kibana was mistakenly allowed to perform a number of operations (e.g. migrations) with Saved Objects (alerts, actions etc.) using the ephemeral encryption key that's automatically generated when xpack.encryptedSavedObjects.encryptionKey isn't specified. This could potentially lead to a data-loss since ephemeral key is lost after restart. It's no longer the case with this fix.

azasypkin · 2021-02-09T13:28:08Z

x-pack/plugins/fleet/kibana.json

@@ -4,14 +4,13 @@
  "server": true,
  "ui": true,
  "configPath": ["xpack", "fleet"],
-  "requiredPlugins": ["licensing", "data"],
+  "requiredPlugins": ["licensing", "data", "encryptedSavedObjects"],


note: for 7.12 we decided to not disable plugin automatically and since you still depend SO migrations it makes sense to keep this as a required dependency for now. Let me know if you have any concerns.

Make sense 👍 and we will fix our SO migration

elasticmachine · 2021-02-09T13:48:55Z

Pinging @elastic/kibana-security (Team:Security)

elasticmachine · 2021-02-09T16:13:22Z

Pinging @elastic/fleet (Team:Fleet)

YulNaumenko

Alerting changes LGTM

nchaulet

Fleet changes 👍

chrisronline

LGTM for Stack Monitoring!

legrego

Tested locally, looks great!

legrego · 2021-02-09T18:43:54Z

x-pack/plugins/encrypted_saved_objects/server/plugin.ts

@@ -26,8 +25,8 @@ export interface PluginsSetup {
 }

 export interface EncryptedSavedObjectsPluginSetup {
+  canEncrypt: boolean;


optional It's probably a good idea to start documenting our public interface

Suggested change

canEncrypt: boolean;

/** Indicates if Saved Object encryption is possible. Requires an encryption key to be explicitly set via `xpack.encryptedSavedObjects.encryptionKey`. */

canEncrypt: boolean;

Definitely agree, thanks!

legrego · 2021-02-09T18:47:24Z

x-pack/plugins/encrypted_saved_objects/server/config.test.ts

@@ -32,6 +29,17 @@ describe('config schema', () => {
      }
    `);

+    expect(ConfigSchema.validate({ encryptionKey: 'z'.repeat(32) }, { dist: true }))


I know that this is probably "testing the library", but would you mind adding a test to ensure that encryptionKey cannot be null when dist: true? Plugin code checks that the key isn't undefined, but if schema.maybe() ever allowed null, then we would incorrectly assume that an encryption key was set.

Good idea, will add, thanks

FrankHassanabad

Looked it over for security_solutions, this looks 👍 , lgtm

…key, document `canEncrypt`.

kibanamachine · 2021-02-10T10:23:51Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request
Commit: e6cbf58

Metrics [docs]

✅ unchanged

History

💚 Build #105105 succeeded 28a6846

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

azasypkin · 2021-02-10T12:30:13Z

7.x/7.12.0: fc4beaf

* master: (99 commits) [Fleet] Use Fleet Server indices in the search bar (elastic#90835) [Search Sessions] added an info flyout to session management (elastic#90559) [ILM] Revisit searchable snapshot field after new redesign (elastic#90793) [Alerting] License Errors on Alert List View (elastic#89920) RFC Improve saved object migrations algorithm (elastic#84333) [Lens] (Accessibility) Fix focus on drag and drop actions (elastic#90561) Use new shortcut links to Fleet discuss forums. (elastic#90786) Do not generate an ephemeral encryption key in production. (elastic#81511) [Fleet] Use staging registry for snapshot builds (elastic#90327) Actually deleting x-pack/tsconfig.refs.json (elastic#90898) Add deprecation warning to all Beats CM pages. (elastic#90741) skip flaky suite (elastic#90136) Revert "Revert "[Metrics UI] Add Metrics Anomaly Alert Type (elastic#89244)"" (elastic#90889) remove ref to removed tsconfig file [core.logging] Uses host timezone as default (elastic#90368) [Maps] remove maps_file_upload plugin and fold public folder into file_upload plugin (elastic#90292) Revert "[Metrics UI] Add Metrics Anomaly Alert Type (elastic#89244)" [dev-utils/ci-stats] support disabling ship errors (elastic#90851) Prefix with / (elastic#90836) [Metrics UI] Add Metrics Anomaly Alert Type (elastic#89244) ...

azasypkin added release_note:fix Team:Security Team focused on: Auth, Users, Roles, Spaces, Audit Logging, and more! v7.11.0 v7.12.0 and removed v7.11.0 labels Oct 22, 2020

azasypkin added the blocked label Dec 31, 2020

azasypkin force-pushed the issue-xxx-optional-eso branch from 1867d85 to 48c4da0 Compare December 31, 2020 12:41

azasypkin mentioned this pull request Jan 7, 2021

Make encryptedSavedObjects plugin dependency optional and stop relying on usingEphemeralEncryptionKey #81618

Closed

pmuellr mentioned this pull request Jan 13, 2021

[Alerts][Actions] Removed isESOUsingEphemeralEncryptionKey determination. Set ESO plugin as a required dependency for Actions and Alerts plugins. Changed UI to show the proper info for disabled ESO plugin. #87936

Closed

azasypkin force-pushed the issue-xxx-optional-eso branch 2 times, most recently from 045755d to 6fb6495 Compare February 9, 2021 11:14

azasypkin changed the title ~~Disable EncryptedSavedObjects plugin in production if encryption key is not specified.~~ Do not generate an ephemeral encryption key in production. Feb 9, 2021

Do not generate an ephemeral encryption key in production.

28a6846

azasypkin force-pushed the issue-xxx-optional-eso branch from 6fb6495 to 28a6846 Compare February 9, 2021 11:42

azasypkin removed the blocked label Feb 9, 2021

azasypkin commented Feb 9, 2021

View reviewed changes

azasypkin marked this pull request as ready for review February 9, 2021 13:48

azasypkin requested review from a team as code owners February 9, 2021 13:48

azasypkin requested review from nchaulet and chrisronline February 9, 2021 16:10

botelastic bot added the Team:Fleet Team label for Observability Data Collection Fleet team label Feb 9, 2021

YulNaumenko approved these changes Feb 9, 2021

View reviewed changes

nchaulet approved these changes Feb 9, 2021

View reviewed changes

chrisronline approved these changes Feb 9, 2021

View reviewed changes

legrego approved these changes Feb 9, 2021

View reviewed changes

FrankHassanabad approved these changes Feb 9, 2021

View reviewed changes

azasypkin added 2 commits February 10, 2021 08:47

Merge branch 'master' into issue-xxx-optional-eso

0a12c30

Review#1: make sure null values are not allowed for the encryption …

e6cbf58

…key, document `canEncrypt`.

azasypkin merged commit 03a53b9 into elastic:master Feb 10, 2021

azasypkin deleted the issue-xxx-optional-eso branch February 10, 2021 10:27

azasypkin mentioned this pull request Feb 10, 2021

[7.x] Do not generate an ephemeral encryption key in production. (#81511) #90917

Merged

azasypkin added the backported label Feb 10, 2021

lucabelluccini mentioned this pull request Apr 19, 2021

API to clean up not decryptable saved objects #97453

Open

nchaulet mentioned this pull request Apr 1, 2022

[Fleet] Encrypt ssl fields in logstash output #129131

Merged

legrego mentioned this pull request Apr 4, 2022

Remove docs reference to ephemeral encryption key #129328

Closed

azasypkin mentioned this pull request Apr 4, 2022

Remove docs reference to ephemeral encryption key. #129331

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Do not generate an ephemeral encryption key in production. #81511

Do not generate an ephemeral encryption key in production. #81511

azasypkin commented Oct 22, 2020 •

edited

Loading

azasypkin Feb 9, 2021

nchaulet Feb 9, 2021

elasticmachine commented Feb 9, 2021

elasticmachine commented Feb 9, 2021

YulNaumenko left a comment

nchaulet left a comment

chrisronline left a comment

legrego left a comment

legrego Feb 9, 2021

azasypkin Feb 10, 2021

legrego Feb 9, 2021

azasypkin Feb 10, 2021

FrankHassanabad left a comment

kibanamachine commented Feb 10, 2021

azasypkin commented Feb 10, 2021

	canEncrypt: boolean;
	/** Indicates if Saved Object encryption is possible. Requires an encryption key to be explicitly set via `xpack.encryptedSavedObjects.encryptionKey`. */
	canEncrypt: boolean;

Do not generate an ephemeral encryption key in production. #81511

Do not generate an ephemeral encryption key in production. #81511

Conversation

azasypkin commented Oct 22, 2020 • edited Loading

Release note

azasypkin Feb 9, 2021

Choose a reason for hiding this comment

nchaulet Feb 9, 2021

Choose a reason for hiding this comment

elasticmachine commented Feb 9, 2021

elasticmachine commented Feb 9, 2021

YulNaumenko left a comment

Choose a reason for hiding this comment

nchaulet left a comment

Choose a reason for hiding this comment

chrisronline left a comment

Choose a reason for hiding this comment

legrego left a comment

Choose a reason for hiding this comment

legrego Feb 9, 2021

Choose a reason for hiding this comment

azasypkin Feb 10, 2021

Choose a reason for hiding this comment

legrego Feb 9, 2021

Choose a reason for hiding this comment

azasypkin Feb 10, 2021

Choose a reason for hiding this comment

FrankHassanabad left a comment

Choose a reason for hiding this comment

kibanamachine commented Feb 10, 2021

💚 Build Succeeded

Metrics [docs]

History

azasypkin commented Feb 10, 2021

azasypkin commented Oct 22, 2020 •

edited

Loading