Setting up ReadonlyREST

How to Set up ReadonlyREST

The Elasticsearch Security Paradigm

What Is ReadonlyREST?

Design and Architecture

1. The user agent (i.e., cURL or Kibana) sends a search request to Elasticsearch using the port 9200 and the HTTPS URL schema.

2. The plugin’s HTTPS filter unwraps the SSL layer and hands over the request to the Elasticsearch HTTP stack.

3. The HTTP stack in Elasticsearch parses the HTTP request.

4. The HTTP handler in Elasticsearch extracts the indices, action, and request type, and creates a search request (internal Elasticsearch format).

5. The search request goes through the ACL; external systems such as LDAP can be asynchronously queried; and an exit result is eventually produced.

6. The exit result is used by the audit log serializer to write an index record and/or Elasticsearch log file.

7. If an ACL block wasn’t matched, or if a type: forbid block was matched, ReadonlyREST does not forward the search request to the search engine. Rather, it creates an "unauthorized" HTTP response.

8. If the ACL did match with the type: allow block, the request is forwarded to the search engine.

9. The Elasticsearch code creates a search response containing the results of the query.

10. The Elasticsearch code converts the search response to an HTTP response.

11. The HTTP response flows back to ReadonlyREST's HTTPS filter and to the user agent.

Key Features

• Encryption: Transforms the Elasticsearch API from HTTP to HTTPS.

• Authentication: Requires credentials.

• Authorization: Declares groups of users, permissions, and partial access to indices.

• Access control: An ACL written in YAML can be used to model complex logic.

• Audit logs: A trace of the access requests can be logged to file or index (or both).

Advantages

• Elastic’s “xpack.security” module in the non-free Elastic Stack

• Reverse proxy using NGINX with basic HTTP authentication

• Your cluster is still insecure on the server it’s running on, and anyone who has direct access to the node can use the Elasticsearch port to perform all the operations.

• Misconfiguring a node's firewall can still lead to vulnerabilities.

• Elasticsearch has a vast number of non-standard REST API endpoints, and getting the right configuration for access control is almost impossible.

• Freely available: All the Elasticsearch security features—such as encryption, authentication, authorization, and access control—are free.

• Easy setup: The ReadonlyREST Free plugin is very easy to install and set up, and there’s great support available if you run into difficulties.

• Easy integration into an existing stack: It is also very easy to integrate the ReadonlyREST Free plugin into an existing stack because you can get the basic security features by configuring it on only one node. In addition, it’s simple to integrate with LDAP for authentication.

• Robust features: The ReadonlyREST Free plugin’s security features are more robust than the free features provided by Elasticsearch itself.

• Less expensive: The ReadonlyREST Enterprise plugin (which is needed for Kibana) is much less expensive than the commercial Elasticsearch module. In addition, ReadonlyREST’s fixed pricing model will future-proof your organization as ES clusters and nodes grow.

• Customization options: Enterprises can inject CSS and Javascript into the look and feel of the ReadonlyREST Enterprise plugin for Kibana, making it seamless for end users.

Integrating ReadonlyREST into ELK Clusters

Points to Consider Before Starting

1. Install the plugin on a dedicated client node that exposes the HTTP interface over port 9200. You don’t need to install the plugin on all of the nodes in the cluster, and for security hardening, you can even disable the HTTP port on all other nodes. The only drawback of this approach is that document-level security and field-level security are not going to work.

2. Install the plugin on all client and data nodes in the cluster. This approach is necessary when you need document-level and filter-level security. Document-level security helps you ensure that only the documents that satisfy the query provided as an argument are returned. On the other hand, field-level security ensures that only certain fields from queries are returned.

Prerequisites

Installing and Configuring the ReadonlyREST Free Plugin for Elasticsearch

1. Navigate to your Elasticsearch home directory and install the plugin using the following command:

bin/elasticsearch-plugin install file://<download_dir>/readonlyrest-<ROR_VERSION>_es<ES_VERSION>.zip

bin/elasticsearch-plugin install file:///tmp/readonlyrest-1.18.7_es7.3.2.zip

1. Accept the warning message and continue installation.

1. Disable the X-Pack security plugin by adding the following parameter inside the elasticsearch.yml file:

1. Create and edit a file inside the Elasticsearch config directory, parallel to elasticsearch.yml:

1. Now write some basic settings, as shown below:

readonlyrest:
	access_control_rules:
	- name: "Require HTTP Basic Auth"
		type: allow
		auth_key: elasticuser:somerandomepassword

1. Start Elasticsearch.

1. Test if the authentication was successful by executing a GET request.

Understanding ReadonlyREST’s Authentication Settings

readonlyrest:
	access_control_rules:
	- name: "Require HTTP Basic Auth"
		type: allow
		auth_key: elasticuser:somerandomepassword
		
	- name: "Require HTTP Basic Auth second block"
		type: allow
		auth_key: seconduser:password123

Adding SSL Encryption

1. Open the elasticsearch.yml file and add the following:

1. Copy your keystroke.jks file inside the Elasticsearch config directory, parallel to the elasticsearch.yml file.

2. Add the SSL settings to the readonlyrest.yml file. The complete file should now look like this:

readonlyrest:
	ssl:
		keystore_file: "keystore.jks"
		keystore_pass: qwerty123
		key_pass: qwerty123
		
	access_control_rules:
	- name: "Require HTTP Basic Auth"
		type: allow
		auth_key: elasticuser:somerandomepassword

1. Restart Elasticsearch.

2. Test the encryption using a cURL command:

Sending Data from Logstash to ReadonlyREST-Enabled Elasticsearch

output {
	elasticsearch {
	ssl => true
	ssl_certificate_verification => false
	hosts => ["YOUR_ELASTICSEARCH_HOST:9200"]
	user => elasticuser
	password => somerandomepassword
	}
}

username: elasticuser
password: somerandomepassword
protocol: https
hosts: ["YOUR_ELASTICSEARCH_HOST:9200"]
index: "log_metricbeat-%{+yyyy.MM}"

elasticsearch.username: "elasticuser"
elasticsearch.password: "somerandomepassword"

Summary