Auto-configure the elastic user password #78306

albertzaharovits · 2021-09-27T08:39:26Z

This adds a new way to specify the initial password for the elastic superuser.

This makes use of the new autoconfiguration.password_hash secure setting.
This setting contains the elastic user's password hash, which is used to validate
the elastic's credentials, as long as there are no other alternatives in the
.security index (either if the index does not exist, or if it does not contain
the document for the elastic user).
Still, the interesting thing, which sets this new setting apart from the bootstrap.password
existing one, is that upon a successful validation the hash is written back on the .security index.
Importantly, if the write fails, it results in a 500 or 503 error to the client, rather than a 401.
This has the result that all the other nodes will use the same elastic password from the index
from that point on.

This whole mechanism facilitates fixing the elastic user password, for a cluster, before its
nodes are started.

Replaces #77036
Co-Authored-By: Lyudmila Fokina [email protected]

albertzaharovits · 2021-09-28T17:34:24Z

@elasticmachine run elasticsearch-ci/part-2

albertzaharovits · 2021-09-30T16:17:37Z

...in/java/org/elasticsearch/xpack/core/security/authc/DefaultAuthenticationFailureHandler.java

+        if (e instanceof ElasticsearchAuthenticationProcessingError) {
+            return (ElasticsearchAuthenticationProcessingError) e;
+        }
        return createAuthenticationError("error attempting to authenticate request", e, (Object[]) null);


Only raising exceptions with a specific type (ElasticsearchAuthenticationProcessingError) AND while invoking the request processing error handler (and not any other handler), results in 500 or 503; anything else goes to 401 .

albertzaharovits · 2021-09-30T16:19:15Z

...security/src/internalClusterTest/java/org/elasticsearch/test/SecuritySingleNodeTestCase.java

+    protected SecureString getBootstrapPassword() {
+        return TEST_PASSWORD_SECURE_STRING;
+    }
+


I need this in order to override to not set the bootstrap password.

albertzaharovits · 2021-09-30T16:23:48Z

...in/security/src/main/java/org/elasticsearch/xpack/security/authc/esnative/ReservedRealm.java


    public ReservedRealm(Environment env, Settings settings, NativeUsersStore nativeUsersStore, AnonymousUser anonymousUser,
-                         SecurityIndexManager securityIndex, ThreadPool threadPool) {
+                         ThreadPool threadPool) {


Accounting for if the security index exists is redundant because the native users store does it already.

elasticmachine · 2021-09-30T16:52:17Z

Pinging @elastic/es-security (Team:Security)

jkakavas

This is superb Albert. I like how clean ReservedRealm#doAuthenticate is and the diligence you put into testing. I verified manually too that this does work as advertised ( happy path ) and the test coverage for error cases makes me confident to merge. I'll wait for Lyudmila to share any thoughts are she has spent time on this too and has context from the previous PR, but LGTM from my side

...in/java/org/elasticsearch/xpack/core/security/authc/DefaultAuthenticationFailureHandler.java

...in/security/src/main/java/org/elasticsearch/xpack/security/authc/esnative/ReservedRealm.java

jkakavas

some testing nits

...rg/elasticsearch/xpack/security/authc/esnative/ReservedRealmElasticAutoconfigIntegTests.java

...curity/src/test/java/org/elasticsearch/xpack/security/authc/esnative/ReservedRealmTests.java

albertzaharovits · 2021-10-05T07:54:06Z

@elasticmachine test this please

This commit ensures that for packaged installations we will run the auto-configuration code on installation (but not upgrade) time. This is needed because we expect elasticsearch to be run as a service. By the time the service runs, the configuration directory is not writable by the user that runs elasticsearch so we can't persist configuration and key/certificate material on runtime. Running auto-configuration on installation time allows us to print information to the user that they have better chance of seeing (barring unattended installations). We don't have the option to show output to the user when starting the service with systemctl. During installation we: - Generate TLS material, enable security and TLS and persist on disk - Generate a password for the elastic user and store a hash of this in the elasticsearch.keystore. This will be picked up by the node starting and will be "promoted" to be the cluster wide elastic password on first startup. (see #78306 ) - We notify the user in the output of the package installation about whether we succeed and what the password of the elastic user is.

Main

10f3474

albertzaharovits self-assigned this Sep 27, 2021

elasticsearchmachine added the v8.0.0 label Sep 27, 2021

albertzaharovits added 3 commits September 27, 2021 12:07

Nit rename & javadoc

6076aab

ReservedRealm security index param remove fallout

674202d

Merge branch 'master' into set-auto-conf-password

98e3ed9

BigPandaToo self-requested a review September 27, 2021 09:40

albertzaharovits added 6 commits September 27, 2021 21:39

WIP

ccd1dbe

ReservedRealm tests

c2092d8

Merge branch 'master' into set-auto-conf-password

0b89640

Exception serialization test

e8b390c

Almost

93abfb2

ReservedRealm tests

ed8646f

albertzaharovits added 6 commits September 29, 2021 08:19

NativeUsersStoreTests

53443bd

isElasticUserAutoConfigured

5645b7d

Negative integ tests

14e1f36

Merge branch 'master' into set-auto-conf-password

a7e4c49

Merge fallout

4128d61

Checkstyle

59c2542

albertzaharovits commented Sep 30, 2021

View reviewed changes

Nit

299c710

albertzaharovits commented Sep 30, 2021

View reviewed changes

albertzaharovits added >enhancement :Security/Authentication Logging in, Usernames/passwords, Realms (Native/LDAP/AD/SAML/PKI/etc) labels Sep 30, 2021

albertzaharovits requested a review from jkakavas September 30, 2021 16:51

albertzaharovits marked this pull request as ready for review September 30, 2021 16:52

elasticmachine added the Team:Security Meta label for security team label Sep 30, 2021

jkakavas approved these changes Sep 30, 2021

View reviewed changes

...in/java/org/elasticsearch/xpack/core/security/authc/DefaultAuthenticationFailureHandler.java Outdated Show resolved Hide resolved

jkakavas reviewed Oct 1, 2021

View reviewed changes

...in/security/src/main/java/org/elasticsearch/xpack/security/authc/esnative/ReservedRealm.java Outdated Show resolved Hide resolved

jkakavas reviewed Oct 1, 2021

View reviewed changes

...in/security/src/main/java/org/elasticsearch/xpack/security/authc/esnative/ReservedRealm.java Outdated Show resolved Hide resolved

jkakavas approved these changes Oct 2, 2021

View reviewed changes

albertzaharovits added 3 commits October 4, 2021 21:17

Merge branch 'master' into set-auto-conf-password

0ecbead

Review Ioannis

cf0f4b3

Integ test for authn success after promotion failure

b249f9c

albertzaharovits added the :Security/FIPS Running ES in FIPS 140-2 mode label Oct 5, 2021

albertzaharovits merged commit cfadab4 into elastic:master Oct 5, 2021

albertzaharovits deleted the set-auto-conf-password branch October 5, 2021 08:45

albertzaharovits mentioned this pull request Oct 5, 2021

Setting elastic password from stored hash #77036

Closed

This was referenced Oct 14, 2021

Security auto-configuration for packaged installations #75144

Merged

Set elastic password from stored hash for packaged installations #75704

Closed

jakelandis added v8.0.0-beta1 and removed v8.0.0 labels Oct 27, 2021

Auto-configure the elastic user password #78306

Auto-configure the elastic user password #78306

Uh oh!

Conversation

albertzaharovits commented Sep 27, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

albertzaharovits commented Sep 28, 2021

Uh oh!

albertzaharovits Sep 30, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

albertzaharovits Sep 30, 2021

Choose a reason for hiding this comment

Uh oh!

albertzaharovits Sep 30, 2021

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Sep 30, 2021

Uh oh!

jkakavas left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jkakavas left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

albertzaharovits commented Oct 5, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

albertzaharovits commented Sep 27, 2021 •

edited

Loading

albertzaharovits Sep 30, 2021 •

edited

Loading