opensource/graylog2-server
1
0
Fork 0
mirror of https://github.com/Graylog2/graylog2-server.git synced 2026-03-13 09:32:21 +08:00
Code Issues Packages Projects Releases Wiki Activity

DataNode: Client Cert Generation (#18522)

Browse Source 
* client cert research part1

* client cert research part2

* remove changes in roles_mapping

* ClientCertGenerator refactoring

* ClientCertGenerator JSON etc

* adding changelog

* lowercase url

* adding audit events

* base64 encoding the cert file name

* fix call

* fix test, adding missing event types

* added correct result mapping

* fixing imports
This commit is contained in:
Jan Heise
2024-03-13 09:57:05 +01:00
committed by GitHub
parent e9e46c5805
commit 7d8093d7a9
19 changed files with 538 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
data-node/src/main/java/org/graylog/datanode/Configuration.java
View File

@@ -263,6 +263,20 @@ public class Configuration extends BaseConfiguration {
return indicesQueryBoolMaxClauseCount;
}
@Parameter(value = "opensearch_logger_org_opensearch")
private String opensearchDebug;
public String getOpensearchDebug() {
return opensearchDebug;
}
@Parameter(value = "opensearch_plugins_security_audit_type")
private String opensearchAuditLog;
public String getOpensearchAuditLog() {
return opensearchAuditLog;
}
public boolean isInsecureStartup() {
return insecureStartup;
}

9
data-node/src/main/java/org/graylog/datanode/configuration/OpensearchConfigurationProvider.java
View File

@@ -152,8 +152,13 @@ public class OpensearchConfigurationProvider implements Provider<OpensearchConfi
//config.put("network.publish_host", Tools.getLocalCanonicalHostname());
// Uncomment the following line to get DEBUG logs for the underlying Opensearch
//config.put("logger.org.opensearch", "debug");
if(localConfiguration.getOpensearchDebug() != null && !localConfiguration.getOpensearchDebug().isBlank()) {
config.put("logger.org.opensearch", localConfiguration.getOpensearchDebug());
}
if(localConfiguration.getOpensearchAuditLog() != null && !localConfiguration.getOpensearchAuditLog().isBlank()) {
config.put("plugins.security.audit.type", localConfiguration.getOpensearchAuditLog());
}
// common OpenSearch config parameters from our docs
config.put("indices.query.bool.max_clause_count", localConfiguration.getIndicesQueryBoolMaxClauseCount().toString());

5
data-node/src/main/java/org/graylog/datanode/configuration/variants/OpensearchSecurityConfiguration.java
View File

@@ -121,6 +121,9 @@ public class OpensearchSecurityConfiguration {
config.put("plugins.security.ssl.http.truststore_type", TRUSTSTORE_FORMAT);
config.put("plugins.security.ssl.http.truststore_filepath", TRUSTSTORE_FILE.toString());
config.put("plugins.security.ssl.http.truststore_password", truststore.passwordAsString());
// enable client cert auth
config.put("plugins.security.ssl.http.clientauth_mode", "OPTIONAL");
} else {
config.put("plugins.security.disabled", "true");
config.put("plugins.security.ssl.http.enabled", "false");
@@ -175,7 +178,7 @@ public class OpensearchSecurityConfiguration {
config.put("plugins.security.enable_snapshot_restore_privilege", "true");
config.put("plugins.security.check_snapshot_restore_write_privileges", "true");
config.put("plugins.security.restapi.roles_enabled", "all_access,security_rest_api_access");
config.put("plugins.security.restapi.roles_enabled", "all_access,security_rest_api_access,readall");
config.put("plugins.security.system_indices.enabled", "true");
config.put("plugins.security.system_indices.indices", ".plugins-ml-model,.plugins-ml-task,.opendistro-alerting-config,.opendistro-alerting-alert*,.opendistro-anomaly-results*,.opendistro-anomaly-detector*,.opendistro-anomaly-checkpoints,.opendistro-anomaly-detection-state,.opendistro-reports-*,.opensearch-notifications-*,.opensearch-notebooks,.opensearch-observability,.opendistro-asynchronous-search-response*,.replication-metadata-store");
config.put("node.max_local_storage_nodes", "3");