From af09427ec0dbb57b192d044bed6f14cf68a03dfc Mon Sep 17 00:00:00 2001 From: sebdet Date: Thu, 17 Oct 2019 16:16:12 +0200 Subject: [PATCH] Remove all search guard Remove all files related to search guard and all config files + disable the build of the clamp ELK stack Issue-ID: CLAMP-506 Change-Id: I2fe1a9c50381dd31d3fbbb6485cfa8ba2b3f29a8 Signed-off-by: sebdet --- pom.xml | 32 --- src/main/docker/elasticsearch/Dockerfile | 7 - src/main/docker/elasticsearch/bin/init_sg.sh | 7 - .../docker/elasticsearch/config/elasticsearch.yml | 11 - .../elasticsearch/config/sg/kirk-keystore.jks | Bin 4525 -> 0 bytes .../elasticsearch/config/sg/node-0-keystore.jks | Bin 4593 -> 0 bytes .../elasticsearch/config/sg/sg_action_groups.yml | 153 ----------- .../docker/elasticsearch/config/sg/sg_config.yml | 148 ---------- .../elasticsearch/config/sg/sg_internal_users.yml | 45 ---- .../docker/elasticsearch/config/sg/sg_roles.yml | 300 --------------------- .../elasticsearch/config/sg/sg_roles_mapping.yml | 34 --- .../docker/elasticsearch/config/sg/truststore.jks | Bin 1096 -> 0 bytes src/main/docker/elasticsearch/my-entrypoint.sh | 7 - src/main/docker/kibana/Dockerfile | 5 +- src/main/docker/kibana/conf/kibana.yml | 3 - 15 files changed, 1 insertion(+), 751 deletions(-) delete mode 100644 src/main/docker/elasticsearch/bin/init_sg.sh delete mode 100644 src/main/docker/elasticsearch/config/sg/kirk-keystore.jks delete mode 100644 src/main/docker/elasticsearch/config/sg/node-0-keystore.jks delete mode 100644 src/main/docker/elasticsearch/config/sg/sg_action_groups.yml delete mode 100644 src/main/docker/elasticsearch/config/sg/sg_config.yml delete mode 100644 src/main/docker/elasticsearch/config/sg/sg_internal_users.yml delete mode 100644 src/main/docker/elasticsearch/config/sg/sg_roles.yml delete mode 100644 src/main/docker/elasticsearch/config/sg/sg_roles_mapping.yml delete mode 100644 src/main/docker/elasticsearch/config/sg/truststore.jks diff --git a/pom.xml b/pom.xml index c0f31e93..b6b504aa 100644 --- a/pom.xml +++ b/pom.xml @@ -945,38 +945,6 @@ - - onap/clamp-dashboard-logstash - onap-clamp-dashboard-logstash - - true - - - true - - latest - ${project.docker.latesttagtimestamp.version} - ${project.docker.latesttag.version} - - logstash/Dockerfile - - - - onap/clamp-dashboard-kibana - onap-clamp-dashboard-kibana - - true - - - true - - latest - ${project.docker.latesttagtimestamp.version} - ${project.docker.latesttag.version} - - kibana/Dockerfile - - diff --git a/src/main/docker/elasticsearch/Dockerfile b/src/main/docker/elasticsearch/Dockerfile index 24352429..a6d16150 100644 --- a/src/main/docker/elasticsearch/Dockerfile +++ b/src/main/docker/elasticsearch/Dockerfile @@ -1,17 +1,10 @@ # https://github.com/elastic/elasticsearch-docker FROM docker.elastic.co/elasticsearch/elasticsearch-oss:6.6.2 -COPY config/sg/ config/sg/ COPY config/ config/ COPY bin/ bin/ -#RUN chmod +x bin/init_sg.sh COPY my-entrypoint.sh /usr/local/bin/my-entrypoint.sh RUN chmod a+x /usr/local/bin/my-entrypoint.sh -# Search Guard plugin -RUN elasticsearch-plugin install --batch com.floragunn:search-guard-6:6.6.2-25.1 \ - && chmod +x plugins/search-guard-6/tools/*.sh \ - && chown -R elasticsearch config/sg/ \ - && chmod -R go= config/sg/ # Add your elasticsearch plugins setup here # Example: RUN elasticsearch-plugin install analysis-icu diff --git a/src/main/docker/elasticsearch/bin/init_sg.sh b/src/main/docker/elasticsearch/bin/init_sg.sh deleted file mode 100644 index 1c4e607c..00000000 --- a/src/main/docker/elasticsearch/bin/init_sg.sh +++ /dev/null @@ -1,7 +0,0 @@ -#!/bin/sh -plugins/search-guard-6/tools/sgadmin.sh \ - -cd config/sg/ \ - -ts config/sg/truststore.jks \ - -ks config/sg/kirk-keystore.jks \ - -nhnv \ - -icl \ No newline at end of file diff --git a/src/main/docker/elasticsearch/config/elasticsearch.yml b/src/main/docker/elasticsearch/config/elasticsearch.yml index 4d46ca01..d80ad20f 100644 --- a/src/main/docker/elasticsearch/config/elasticsearch.yml +++ b/src/main/docker/elasticsearch/config/elasticsearch.yml @@ -20,14 +20,3 @@ discovery.type: single-node # #xpack.license.self_generated.type: basic #xpack.security.enabled: false - -## Search Guard -# -searchguard.enterprise_modules_enabled: false - -searchguard.ssl.transport.keystore_filepath: sg/node-0-keystore.jks -searchguard.ssl.transport.truststore_filepath: sg/truststore.jks -searchguard.ssl.transport.enforce_hostname_verification: false - -searchguard.authcz.admin_dn: - - "CN=kirk,OU=client,O=client,l=tEst,C=De" diff --git a/src/main/docker/elasticsearch/config/sg/kirk-keystore.jks b/src/main/docker/elasticsearch/config/sg/kirk-keystore.jks deleted file mode 100644 index dd7562ef81822291c9e48be60b6daef2883288a9..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 4525 zcmdVccT^MWwgB){LPGDoiG|JtLlcmi&;&(_6h#7rP(uq{DS;pYA_Afmm4HYQP!tF# zO+it?LY1P3NK;Ux3W)H6$9wKM=ic}3T5sJy?)_ud%--LgH8bDr`F*qXdFwL>1cER& z@XrnA;}zt?2;6|iLvA1t91KukKLBYi?ob|vHEVPXTvFy98Cf88WeS!f7A?SFPvZg)V z7v6j;sEtmwpQf&7q@7zop%6{r2s~o4`h$O*s-O*b>U-1znW*c#zSZBch%8xV*PK!@M#{2`WZYarXxm&{`QatOX?4u9M`&!g z&8@j*V|x00YnIuVYvX+t0oL3*%ZApt%D}TBgx;82*eFi6zP*KyC^rTTB}T2_jyE(_ z;f-sVA5zg)Q)lMvlIJLf*G91S{6-yTXOSiB%Pl6=)ezz52b@>D2PMdN`A#<=9WZ-| z7KW!1+>q&M9FI4m)Uo2)<*krrUc5S@Z)L7G7dgI!>|D_H@?HQ2<&8$8eAM5V`nS_j zNpG-+#Ccy*OAKTS(OGuQwm4>u0HI3?WwUI`J?nS!O@}YqX!P0n!lx^wZ-xy>9X%}X z%zmko=qLu(IqcUGH-zYG9NL}p(8Yv5_N2}HLil{#_GY+#+?8~+txTk4E?9{>Y6;8Q zEZMQQG+Zc7(ONjc_Z{R_?;uOgps(gW9B#f(6USN@W|Q~IWxj{osPJ=+k~BeQ@cQL| z$FtVYsZN!ibBkZ5nzYpH;ZHJ%>jHUIYX_z7yg_w(Pt?L{^X(1y1V;C7nhA@9^p>1jxzk4S}xL;ZtiB54PN2WN{SYvv3Rh9rlt7aOkInvb_wo?IeDCPpYvkB~u~s|dnp zzlO4kJt=!g)8MF%;L*>C7`w|&Q5;Zw^-N`BMf^2O*~k34r_QaBMiXr@B`1*OXV;sA z9gZ{qm~Tz#GUS?VMvHuD!B$x1U&)(!$F*Sp&b2~cEiXb}fOVHxav+Cc&lruM_R&V( z{43J!IB|M3ZPcwnQbKw_ebQNXOK%`r0lA@di3f&@c4}>O5mAX}`oa7CAntB*PQV6H z^L0WBm#47xTa;TPT3rIKe{dQg49MoR+S7kZUoEgm8$1*sT7hyWeFN zn%<%O^kC4vVk0^76VKU1bP6oo&2Wj(7bV7r$yWzRuT)$$b)}BoAG@t&D^9#0)4o5t z3!Xb!WQChtbPDCZqnv#{@Cy@D^Gw)@;l6aTSvhyQ&XWfqXs~EWy=uctyrPgS<;cB3 ziFkO@!mSh-w6rR5LZ+*OP##Ou?k-vUl=T*#5wv)XW2;UyNTZj8}9GudhAJ(K5qN?vK^qvH6t3LGn(B3(e+O(u*EW1 zgo5DqN~(Y+2m~`?c&GqQ{_o?!Vs@#_RA&(9SEpn!M%ab_5c z29yHk05S3?2n7rV(d*;#xkoZwk^xiERpN!)4V9H=l4Tn>l)s)UWPUlhW+IW-e}Nd?fsk@0y>16?UrrsO!Hfv0>DAFyj~ z4;Oe+Dtg6e1A$uu6@_fEHn~Tu=r`1LiAGjPWDh&kDWabnW};Hzp#zbs1*P^&lDQn3 zhr`|MiT6!+C&i|>I%eo`0eSDaQI)&vJ`Nd~4)V@wtQn-jj?ItB_B_)Xwk^s@lernM zO6lqvz0uD;>}Ldz03>%+rJfw%-gl1kJbl2iG7Yh2s)~NTOz*9{732Q!JpEGs6V6Or z?v@;35->T4fIz_@a8cZQAa0bgx9TTIG8{VR`$aOlLZ$GqH0yMO z@Y6xHgC39jse&KLbn`{{Q=Dt?sE>A+&5;&KL6?ewqvkimo8(4^)y-6@f|g&srG3>K zOR=S%Q-k-M?40&}c8i-mnBH1sjS;pxgNV#%ZPwef`YO#$*D?j$PZ$l zv{pW;Ex{36V{U;rt7KE%$r;XTZ-@9eYiWqK{GxeG!gsw=N<4qP;JB$*gcAmX#ZTkm zq-$D~{KvLfP0R=BdS#-bj(0KEcF*w_t(~hvN!;6+PE{lAeAu>?ljx1Nff@jeHBiRi z;8P7Z7*;-^Yp6&xT-dBKQxS9QF4n?^yDy1p2?1 z{23BJ<8P2)b|7Jd|FHo6E0OvuRKyY-<<1OEd3a0BM&Rq!?9JVYy#B1+Qd!I5#H&na zk30jH2V789$$yAG~m0RXuJD{3u#WSeCxe~2|f62_g>oeC8H2- ze_UH=t}fpaj}759iKB>E5tqFUk`YL%VC@Mru%ad`VPXugO{!w0WjwP{qm4bia|eAw z%*&+wPLE(jG-lJ5O7spY(>%Nwf zJoPod6ROYp-O|9-fNjCN;-j5sdwH&MMsRxO-8N?0U+SP@S1s;CxMp2EWy){1+$1-p z-DsI!@Z4bXQA?=y)QQ#3-$e2N-2dzmme zbbuEP3)|)lIMxspuEbuJf&jNE&eccAgGAH(;O4$ri-*b+2mD#*+5{X{T+%#m+hwnw zkf-(~ntl3qGJvy}XGYaA_O+L)P&_p4@%st9PcpPWv(828(5o1EE|+dIyIAoDXB5Rx z2VB*Q-H5fTW<9l){gQ8BNW*?6U`6S{ffb#a&3)ZV>)Im)?txTeS&1&gRUu8nNMOgv z+(FN+c$pG?jSUeB*?EX{HtNS#Gz{^Sc$kU#;o^jQwe_IHf@kKow7!c`4=eK)3_^Qx ze7?GX&f}#QwMYDVJliV?LGc3@|E>ar@q@9&P+{tq3gEv?*MFl5|8b7}D-UjPy+2V- zR(n5asG`m*?|e`x$VJQF^3>hqpOW4P>L+*@OdT!pG`Rd)sD7&MgFN|kU=M2@8(Y6w ztRiYPqHa?A_K*Cd0VS>?dqH_B%{`uuhc64=N%<(+p1=57=C#>Iv?CgYyQ>hI6)OpE zamrO&M9IHI$%MboyIg}=uimEGEuTd;oGskcyAn}lHDB0@@N+%$RGxMe6Cr4funqQ$ z(@D`B1+Ln_7dr$zQ;nCclkF8IVs{r0xqV`xp_b29-!1B1zY$=RRk4Wz8NU~@x|U=) z^7_KegkHLFMM4Z#0{ z2OPh900*E95B~5Q@=w3@{|^RoP6f5c3mqhA=})^K1scsL<<#R9%F6QEx{2Rb`ky~z zrY&|YhQ9HW!AbMWFK9)w`=or^w-wr%%ogmWARu$h2!fZ<*ZkVuCOohaSsN5nyOO&>*~TNv9yR<|${+cysDRR3}7H>+p?a9c8v%bU%E#C4CGWvaeW$ oIl4xa=rqgDw#QA?#n3);-E>Npf^^i;kSQ<9A)UYFuMDdGAEFEd8UO$Q diff --git a/src/main/docker/elasticsearch/config/sg/node-0-keystore.jks b/src/main/docker/elasticsearch/config/sg/node-0-keystore.jks deleted file mode 100644 index 5693b7bf88ae5acc096a179fe2d4c9832dabd71a..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 4593 zcmdUxXH-+$w#QR80YYd72pp=SNDVvm-m4<0^j-s@B?zI3(xeFpB8n76suWR(QY;ju zhzckmMZiMuh=L*@M=3Ha7xqfr*EbS~oAP^X}L4Py^ zk>rM#0IAXytj7&NAT&@g8rTMz5J)iu6o87tSfNlF2oMd-_0m;uVszPZHlFdlsJy{9 zL%fbt;HkbjHMh4O+w0k#4->j*hiOlN`0`b%=KNS4rP+7uBBcFz3W2Q z)g-ni){9hfC5eWepNd1R3(qAC=(QVVWt3)_3af6&Fa&;};0uilDHF-&HVaB=Qh}>2 z=ggVgam<{J18>(}FBv;rvfPljMDtfm8iQSw;w7y9!#n7-)of@?>67#{mgz?;N{cJZ z-#@NyrmDIhmyuJyR7a;b!K@c(_kC6*N`BT`=8-{w5@Pi-MrpT#=h*bcY=5<#T>X`5 z+{ruA7H$F&WnLADB4m*}G!NcIQ@oBXPd!8yc_lQR>?+AZgg0Gi^J7ft)4JO++vP<6 z0u|aC;TZp5sQGHpM0nyynL)#wTTG8`&zpR9@{N(_Reu(@&}cARaK8X7OiZ=#*U?KK z7m@5ER|@xcms=1T1V05IPPVgNtmUHD$&J<#OHl2CD+Fmhz zYiU8(-2k9`%;=`6OfhD@A9*+8jFpjF+R|7RN23`qF#v{5WtFAqh1??yh)x83bmV67 zY+=Y04Rmf+ZzWraRrJd7b;SOr;&L=7eO1t6%cqzg4Kbsuk$e`mp#5<7>tdLlWpay0 zcU%v;AE&>QQ$m}nHmkia=9&ZE?)spU^-00vSsc#6kMd&dfUpdE$%FWWF}HJV_XGKs zxEKzt2`i?IB6(QEcn|xhO`f!>+j`Ksf|)I!xBwvz9xpO(QSsA5^UkMCC=~jYva~mZmauEu<0rapM*G&ItkI| zX4n=+s;WMpTB76dmA|1aR0pw$*fLnZU}7VanWN6E?!tA=Do=Sat0(^DOTe)!e7iF? zPs31DZ!n^0l0Q*lci^LOYTM*%xlW)lTVtXxTh58QaR-ld95SFMuD>3N1G)QOR))r9 z6)QSp@2m{Z_1dFTqFDOyUGmmt%KdXV6U17RMC?PD$ZH0yP!1;Gf?2Y|x6ZzlPEJZg zjnM5j*Ph+UTD$R@$Spe2iYFd88vk{_V+RS+27u)Q!H!FXMxJG1k!!8^V zc06%=(12ZSHAwDwdbLIO;^KP<*9|FM@8bICZmE?=Vfb9R&NsAA0_Vx3@QTPFO$Az-vS>F|l_&usPd9Eye zCd&}`>q3I3W*+5mD*BK(?ABhXU}sGVE#x`w3oZ$@ZxuT*8@_#=bjeD2jKj`WlK6H* zNkoll!x^j>XqG0h`DpFw3L;9*+dDK()mpB-NW&@EnbhughHpT zwe<1SFaEZA%Z6Y_;H(>GR<#6YnrLB~iWPh}C}y1Ba@P;IbR@0-%E$0h!PR#sYTtJq zjXQyW?R*SrUf#DMCAmOhhLTWgyIpl%wY?p(_({T*ywKE-4DPB57trNhLQP5@2fgi91twGB?^E}hI69h8ZFF;9B(%(54 z>)}Zz1iAzU;Qd`mL^7U8-n&~#cOR0!vqvD2xF-UMo@6pLRwSGQ0`TMjNnhsxGTvX( zA0I^W#=Bu%{e3{$y*XF`EGQoR7oieO??ZBR_92i0$nih~wFXI`5rqRZG=B^q>IYD;ht>KCAMp1EfiS2nmB`#FmqUx=Qh}7oD)2;r%m{8jF zHrDRLDL4DR!hOKjgiQz_#H~$t8w$NS@p)G)Vq7`!{xE=`lLb@WVLn7iC!unV9F4r0 zGwr#iG9sjn3t?;No?b7`W>T*Te%Kp!VlIgv!&Maduyx;l)_b2Oj(-_7G)1X$Rnotz zjhnHWZ$J8i(!W0V)FJO$fTP+0FH>`-i;W?STTRy2r$!6nD%dr+@3{#y+J_T5xaYFX z{{bWhDv)TwXxQ>EAi@50Twqk{{~eI_|A-?hkU0MZNGC}o@*a(TxxoLu%b!rB@H>iR zexOLf=D!x9{|RON6;ix0Hlp!E)9zmT7ebxy%UKiS5TOcfqY-z`+8B$JMd`Pe&4er zGTaIaDXnw44o6F_cGS%vo6J&&p5>}%FK9{d`INnHx;S}G1n7%mrW|;rj1`L=ikW;0PkS?{BvY_yJ<8PQ2PaAR^`O+Xdtx|7%F|SK& zs;wzVW!iqN<0s18LAQU#7!(2S+k5!vJ*?4z24!+P7|L+-}bwgz&&+SyKz6gJ(_8ONWe&kg9$f6oy=bUhf zrotw7G}&PYwGg(w6AsWm_b@@wHLpy%QB2?Pe=0kkImT{&PClh8|DXblTB7VwsWAO-%as3rRQRu3@qgmMP1Z5{a2wItgT=%DIC&b8SPxYc|85#SJL`opnLTjf~s28 z$*h*ypzOw4d^u15;C#WB#`VxUCzcBy)B3u^KNrhCDHF=6Pir3F8>O10_#VtPqgiRk z5R&!3m?m0@PevXr9&(*$$VYxTPq|mvvvJc;=W@js5~4rGb>c>X@yKA>?4-s;{fd%4 zf$@hn##nFXlKQtEgwM3{l{L~1w$igX$7*8ot8?p1`LF!sfh*|zFFauWI}d0;IF$!~ zs9yf^t^aReAZnXeV^?6!pMUXrPunS-S!~vQXYsPKoR%JsZ(sYnUeM*Qbgl%w^%d3= zD%F*ppHbw08ep@u%!;nSy)r?Q%}op1DmIdIcz?-4JFRp{j`;C;6hYc zGIruPmTV=^uKPVoCU({AsiwPqm}$&BDs~Vk(_?q2vA?YyyVmbM(XB;6E+BP4?V|&Y zz;NO*@#xO==LHFyf@yWbvCF9g5qAs4H?8#piY^}Wx&1XC+1b^lL8g1W{vm1GC&r>y zW!W5PmKkbL%?ql2&XP6Wm^>NQ0h3TRxtXXc$#|g7*SXxdZWJ1LxLArVyqd?uc7ciU fkgKedwpBVyQD_3{J;vvymZy^>PpdUX45j%uEA}fN diff --git a/src/main/docker/elasticsearch/config/sg/sg_action_groups.yml b/src/main/docker/elasticsearch/config/sg/sg_action_groups.yml deleted file mode 100644 index 38ffef02..00000000 --- a/src/main/docker/elasticsearch/config/sg/sg_action_groups.yml +++ /dev/null @@ -1,153 +0,0 @@ -UNLIMITED: - readonly: true - permissions: - - "*" - -###### INDEX LEVEL ###### - -INDICES_ALL: - readonly: true - permissions: - - "indices:*" - -# for backward compatibility -ALL: - readonly: true - permissions: - - INDICES_ALL - -MANAGE: - readonly: true - permissions: - - "indices:monitor/*" - - "indices:admin/*" - -CREATE_INDEX: - readonly: true - permissions: - - "indices:admin/create" - - "indices:admin/mapping/put" - -MANAGE_ALIASES: - readonly: true - permissions: - - "indices:admin/aliases*" - -INDEX_OWNER: - - CREATE_INDEX - - CRUD - -# for backward compatibility -MONITOR: - readonly: true - permissions: - - INDICES_MONITOR - -INDICES_MONITOR: - readonly: true - permissions: - - "indices:monitor/*" - -DATA_ACCESS: - readonly: true - permissions: - - "indices:data/*" - - CRUD - -WRITE: - readonly: true - permissions: - - "indices:data/write*" - - "indices:admin/mapping/put" - -READ: - readonly: true - permissions: - - "indices:data/read*" - - "indices:admin/mappings/fields/get*" - -DELETE: - readonly: true - permissions: - - "indices:data/write/delete*" - -CRUD: - readonly: true - permissions: - - READ - - WRITE - -SEARCH: - readonly: true - permissions: - - "indices:data/read/search*" - - "indices:data/read/msearch*" - - SUGGEST - -SUGGEST: - readonly: true - permissions: - - "indices:data/read/suggest*" - -INDEX: - readonly: true - permissions: - - "indices:data/write/index*" - - "indices:data/write/update*" - - "indices:admin/mapping/put" - - "indices:data/write/bulk*" - -GET: - readonly: true - permissions: - - "indices:data/read/get*" - - "indices:data/read/mget*" - -###### CLUSTER LEVEL ###### - -CLUSTER_ALL: - readonly: true - permissions: - - "cluster:*" - -CLUSTER_MONITOR: - readonly: true - permissions: - - "cluster:monitor/*" - -CLUSTER_COMPOSITE_OPS_RO: - readonly: true - permissions: - - "indices:data/read/mget" - - "indices:data/read/msearch" - - "indices:data/read/mtv" - - "indices:admin/aliases/exists*" - - "indices:admin/aliases/get*" - - "indices:data/read/scroll" - -CLUSTER_COMPOSITE_OPS: - readonly: true - permissions: - - "indices:data/write/bulk" - - "indices:admin/aliases*" - - "indices:data/write/reindex" - - CLUSTER_COMPOSITE_OPS_RO - -MANAGE_SNAPSHOTS: - readonly: true - permissions: - - "cluster:admin/snapshot/*" - - "cluster:admin/repository/*" - -# CLAMPDASHBOARD ELASTICSEARCH ENTRYPOINT -GET_TEMPLATE: - - "indices:admin/template/get" -PUT_TEMPLATE: - - "indices:admin/template/put" -TEMPLATE_OWNER: - - GET_TEMPLATE - - PUT_TEMPLATE -ES_INPUT: - - TEMPLATE_OWNER - - WRITE - - MONITOR diff --git a/src/main/docker/elasticsearch/config/sg/sg_config.yml b/src/main/docker/elasticsearch/config/sg/sg_config.yml deleted file mode 100644 index 9a16a823..00000000 --- a/src/main/docker/elasticsearch/config/sg/sg_config.yml +++ /dev/null @@ -1,148 +0,0 @@ -# This is the main Search Guard configuration file where authentication -# and authorization is defined. -# -# You need to configure at least one authentication domain in the authc of this file. -# An authentication domain is responsible for extracting the user credentials from -# the request and for validating them against an authentication backend like Active Directory for example. -# -# If more than one authentication domain is configured the first one which succeeds wins. -# If all authentication domains fail then the request is unauthenticated. -# In this case an exception is thrown and/or the HTTP status is set to 401. -# -# After authentication authorization (authz) will be applied. There can be zero or more authorizers which collect -# the roles from a given backend for the authenticated user. -# -# Both, authc and auth can be enabled/disabled separately for REST and TRANSPORT layer. Default is true for both. -# http_enabled: true -# transport_enabled: true -# -# 5.x Migration: "enabled: true/false" will also be respected currently but only to provide backward compatibility. -# -# For HTTP it is possible to allow anonymous authentication. If that is the case then the HTTP authenticators try to -# find user credentials in the HTTP request. If credentials are found then the user gets regularly authenticated. -# If none can be found the user will be authenticated as an "anonymous" user. This user has always the username "sg_anonymous" -# and one role named "sg_anonymous_backendrole". -# If you enable anonymous authentication all HTTP authenticators will not challenge. -# -# -# Note: If you define more than one HTTP authenticators make sure to put non-challenging authenticators like "proxy" or "clientcert" -# first and the challenging one last. -# Because it's not possible to challenge a client with two different authentication methods (for example -# Kerberos and Basic) only one can have the challenge flag set to true. You can cope with this situation -# by using pre-authentication, e.g. sending a HTTP Basic authentication header in the request. -# -# Default value of the challenge flag is true. -# -# -# HTTP -# basic (challenging) -# proxy (not challenging, needs xff) -# clientcert (not challenging, needs https) -# host (not challenging) #DEPRECATED, will be removed in a future version. -# host based authentication is configurable in sg_roles_mapping - -# Authc -# internal -# noop - -# Authz -# noop -# -# Some SearchGuard functionality is licensed under Apache-2.0, while other functionality is non-free; -# see https://github.com/floragunncom/search-guard. The functionality enabled in this configuration -# file only include those that are licensed under Apache-2.0. Please use care and review SearchGuard's -# license details before enabling any additional features here. - - -searchguard: - dynamic: - # Set filtered_alias_mode to 'disallow' to forbid more than 2 filtered aliases per index - # Set filtered_alias_mode to 'warn' to allow more than 2 filtered aliases per index but warns about it (default) - # Set filtered_alias_mode to 'nowarn' to allow more than 2 filtered aliases per index silently - #filtered_alias_mode: warn - #kibana: - # see https://github.com/floragunncom/search-guard-docs/blob/master/multitenancy.md - # To make this work you need to install https://github.com/floragunncom/search-guard-module-kibana-multitenancy/wiki - #multitenancy_enabled: true - #server_username: kibanaserver - #index: '.kibana' - #do_not_fail_on_forbidden: false - http: - anonymous_auth_enabled: false - xff: - enabled: false - internalProxies: '192\.168\.0\.10|192\.168\.0\.11' # regex pattern - #internalProxies: '.*' # trust all internal proxies, regex pattern - remoteIpHeader: 'x-forwarded-for' - proxiesHeader: 'x-forwarded-by' - #trustedProxies: '.*' # trust all external proxies, regex pattern - ###### see https://docs.oracle.com/javase/7/docs/api/java/util/regex/Pattern.html for regex help - ###### more information about XFF https://en.wikipedia.org/wiki/X-Forwarded-For - ###### and here https://tools.ietf.org/html/rfc7239 - ###### and https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Remote_IP_Valve - authc: - basic_internal_auth_domain: - http_enabled: true - transport_enabled: true - order: 4 - http_authenticator: - type: basic - challenge: true - authentication_backend: - type: intern - proxy_auth_domain: - http_enabled: false - transport_enabled: false - order: 3 - http_authenticator: - type: proxy - challenge: false - config: - user_header: "x-proxy-user" - roles_header: "x-proxy-roles" - authentication_backend: - type: noop - jwt_auth_domain: - http_enabled: false - transport_enabled: false - order: 0 - http_authenticator: - type: jwt - challenge: false - config: - signing_key: "base64 encoded HMAC key or public RSA/ECDSA pem key" - jwt_header: "Authorization" - jwt_url_parameter: null - roles_key: null - subject_key: null - authentication_backend: - type: noop - clientcert_auth_domain: - http_enabled: false - transport_enabled: false - order: 2 - http_authenticator: - type: clientcert - config: - username_attribute: cn #optional, if omitted DN becomes username - challenge: false - authentication_backend: - type: noop - authz: -# auth_failure_listeners: -# ip_rate_limiting: -# type: ip -# allowed_tries: 10 -# time_window_seconds: 3600 -# block_expiry_seconds: 600 -# max_blocked_clients: 100000 -# max_tracked_clients: 100000 -# internal_authentication_backend_limiting: -# type: username -# authentication_backend: intern -# allowed_tries: 10 -# time_window_seconds: 3600 -# block_expiry_seconds: 600 -# max_blocked_clients: 100000 -# max_tracked_clients: 100000 - \ No newline at end of file diff --git a/src/main/docker/elasticsearch/config/sg/sg_internal_users.yml b/src/main/docker/elasticsearch/config/sg/sg_internal_users.yml deleted file mode 100644 index 1712d379..00000000 --- a/src/main/docker/elasticsearch/config/sg/sg_internal_users.yml +++ /dev/null @@ -1,45 +0,0 @@ -# This is the internal user database -# The hash value is a bcrypt hash and can be generated with plugin/tools/hash.sh - -#password is: admin -admin: - readonly: true - hash: $2a$12$VcCDgh2NDk07JGN0rjGbM.Ad41qVR/YFJcgHp0UGns5JDymv..TOG - roles: - - admin - attributes: - #no dots allowed in attribute names - attribute1: value1 - attribute2: value2 - attribute3: value3 - -#password is: logstash -logstash: - hash: $2a$12$u1ShR4l4uBS3Uv59Pa2y5.1uQuZBrZtmNfqB3iM/.jL0XoV9sghS2 - roles: - - logstash - -#password is: kibanaserver -kibanaserver: - readonly: true - hash: $2a$12$4AcgAt3xwOWadA5s5blL6ev39OXDNhmOesEoo33eZtrq2N0YrU3H. - -#password is: kibanaro -kibanaro: - hash: $2a$12$JJSXNfTowz7Uu5ttXfeYpeYE0arACvcwlPBStB1F.MI7f0U9Z4DGC - roles: - - kibanauser - - readall - -#password is: readall -readall: - hash: $2a$12$ae4ycwzwvLtZxwZ82RmiEunBbIPiAmGZduBAjKN0TXdwQFtCwARz2 - #password is: readall - roles: - - readall - -#password is: snapshotrestore -snapshotrestore: - hash: $2y$12$DpwmetHKwgYnorbgdvORCenv4NAK8cPUg8AI6pxLCuWf/ALc0.v7W - roles: - - snapshotrestore \ No newline at end of file diff --git a/src/main/docker/elasticsearch/config/sg/sg_roles.yml b/src/main/docker/elasticsearch/config/sg/sg_roles.yml deleted file mode 100644 index 1a3a80ce..00000000 --- a/src/main/docker/elasticsearch/config/sg/sg_roles.yml +++ /dev/null @@ -1,300 +0,0 @@ -#: -# cluster: -# - '' -# indices: -# '': -# '': -# - '' -# _dls_: '' -# _fls_: -# - '' -# - '' - -# When a user make a request to Elasticsearch then the following roles will be evaluated to see if the user has -# permissions for the request. A request is always associated with an action and is executed against and index (or alias) -# and a type. If a request is executed against all indices (or all types) then the asterix ('*') is needed. -# Every role a user has will be examined if it allows the action against an index (or type). At least one role must match -# for the request to be successful. If no role match then the request will be denied. Currently a match must happen within -# one single role - that means that permissions can not span multiple roles. - -# For , and simple wildcards and regular expressions are possible. -# A asterix (*) will match any character sequence (or an empty sequence) -# A question mark (?) will match any single character (but NOT empty character) -# Example: '*my*index' will match 'my_first_index' as well as 'myindex' but not 'myindex1' -# Example: '?kibana' will match '.kibana' but not 'kibana' - -# To use a full blown regex you have to pre- and apend a '/' to use regex instead of simple wildcards -# '//' -# Example: '/\S*/' will match any non whitespace characters - -# Important: -# Index, alias or type names can not contain dots (.) in the or expression. -# Reason is that we currently parse the config file into a elasticsearch settings object which cannot cope with dots in keys. -# Workaround: Just configure something like '?kibana' instead of '.kibana' or 'my?index' instead of 'my.index' -# This limitation will likely removed with Search Guard 6 -# -# Some SearchGuard functionality is licensed under Apache-2.0, while other functionality is non-free; -# see https://github.com/floragunncom/search-guard. The functionality enabled in this configuration -# file only include those that are licensed under Apache-2.0. Please use care and review SearchGuard's -# license details before enabling any additional features here. - -# Allows everything, but no changes to searchguard configuration index -sg_all_access: - readonly: true - cluster: - - UNLIMITED - indices: - '*': - '*': - - UNLIMITED - tenants: - admin_tenant: RW - -# Read all, but no write permissions -sg_readall: - readonly: true - cluster: - - CLUSTER_COMPOSITE_OPS_RO - indices: - '*': - '*': - - READ - -# Read all and monitor, but no write permissions -sg_readall_and_monitor: - cluster: - - CLUSTER_MONITOR - - CLUSTER_COMPOSITE_OPS_RO - indices: - '*': - '*': - - READ - -# For users which use kibana, access to indices must be granted separately -sg_kibana_user: - readonly: true - cluster: - - INDICES_MONITOR - - CLUSTER_COMPOSITE_OPS - indices: - '?kibana': - '*': - - MANAGE - - INDEX - - READ - - DELETE - '?kibana-6': - '*': - - MANAGE - - INDEX - - READ - - DELETE - '?kibana_*': - '*': - - MANAGE - - INDEX - - READ - - DELETE - '?tasks': - '*': - - INDICES_ALL - '?management-beats': - '*': - - INDICES_ALL - '*': - '*': - - indices:data/read/field_caps* - - indices:data/read/xpack/rollup* - - indices:admin/mappings/get* - - indices:admin/get - -# For the kibana server -sg_kibana_server: - readonly: true - cluster: - - CLUSTER_MONITOR - - CLUSTER_COMPOSITE_OPS - - cluster:admin/xpack/monitoring* - - indices:admin/template* - - indices:data/read/scroll* - indices: - '?kibana': - '*': - - INDICES_ALL - '?kibana-6': - '*': - - INDICES_ALL - '?kibana_*': - '*': - - INDICES_ALL - '?reporting*': - '*': - - INDICES_ALL - '?monitoring*': - '*': - - INDICES_ALL - '?tasks': - '*': - - INDICES_ALL - '?management-beats*': - '*': - - INDICES_ALL - '*': - '*': - - "indices:admin/aliases*" - -# For logstash and beats -sg_logstash: - cluster: - - ES_INPUT - - CLUSTER_MONITOR - - CLUSTER_COMPOSITE_OPS - - indices:admin/template/get - - indices:admin/template/put - indices: - 'logstash-*': - '*': - - INDEX_OWNER - '*beat*': - '*': - - INDEX_OWNER - 'dmaap*': - '*': - - INDEX_OWNER - 'events*': - '*': - - INDEX_OWNER - 'errors*': - '*': - - INDEX_OWNER - -# Allows adding and modifying repositories and creating and restoring snapshots -sg_manage_snapshots: - cluster: - - MANAGE_SNAPSHOTS - indices: - '*': - '*': - - "indices:data/write/index" - - "indices:admin/create" - -# Allows each user to access own named index -sg_own_index: - cluster: - - CLUSTER_COMPOSITE_OPS - indices: - '${user_name}': - '*': - - INDICES_ALL - -### X-Pack COMPATIBILITY -sg_xp_monitoring: - readonly: true - cluster: - - cluster:monitor/xpack/info - - cluster:monitor/main - - cluster:admin/xpack/monitoring/bulk - indices: - '?monitor*': - '*': - - INDICES_ALL - -sg_xp_alerting: - readonly: true - cluster: - - indices:data/read/scroll - - cluster:admin/xpack/watcher* - - cluster:monitor/xpack/watcher* - indices: - '?watches*': - '*': - - INDICES_ALL - '?watcher-history-*': - '*': - - INDICES_ALL - '?triggered_watches': - '*': - - INDICES_ALL - '*': - '*': - - READ - - indices:admin/aliases/get - -sg_xp_machine_learning: - readonly: true - cluster: - - cluster:admin/persistent* - - cluster:internal/xpack/ml* - - indices:data/read/scroll* - - cluster:admin/xpack/ml* - - cluster:monitor/xpack/ml* - indices: - '*': - '*': - - READ - - indices:admin/get* - '?ml-*': - '*': - - "*" - - -### LEGACY ROLES, FOR COMPATIBILITY ONLY -### WILL BE REMOVED IN SG7, DO NOT USE ANYMORE - -sg_readonly_and_monitor: - cluster: - - CLUSTER_MONITOR - - CLUSTER_COMPOSITE_OPS_RO - indices: - '*': - '*': - - READ - -# Make xpack monitoring work -sg_monitor: - cluster: - - cluster:admin/xpack/monitoring/* - - cluster:admin/ingest/pipeline/put - - cluster:admin/ingest/pipeline/get - - indices:admin/template/get - - indices:admin/template/put - - CLUSTER_MONITOR - - CLUSTER_COMPOSITE_OPS - indices: - '?monitor*': - '*': - - INDICES_ALL - '?marvel*': - '*': - - INDICES_ALL - '?kibana*': - '*': - - READ - '*': - '*': - - indices:data/read/field_caps - -# Make xpack alerting work -sg_alerting: - cluster: - - indices:data/read/scroll - - cluster:admin/xpack/watcher/watch/put - - cluster:admin/xpack/watcher* - - CLUSTER_MONITOR - - CLUSTER_COMPOSITE_OPS - indices: - '?kibana*': - '*': - - READ - '?watches*': - '*': - - INDICES_ALL - '?watcher-history-*': - '*': - - INDICES_ALL - '?triggered_watches': - '*': - - INDICES_ALL - '*': - '*': - - READ diff --git a/src/main/docker/elasticsearch/config/sg/sg_roles_mapping.yml b/src/main/docker/elasticsearch/config/sg/sg_roles_mapping.yml deleted file mode 100644 index 45bb7755..00000000 --- a/src/main/docker/elasticsearch/config/sg/sg_roles_mapping.yml +++ /dev/null @@ -1,34 +0,0 @@ -# In this file users, backendroles and hosts can be mapped to Search Guard roles. -# Permissions for Search Guard roles are configured in sg_roles.yml - -sg_all_access: - readonly: true - backendroles: - - admin - -sg_logstash: - backendroles: - - logstash - -sg_kibana_server: - readonly: true - users: - - kibanaserver - -sg_kibana_user: - backendroles: - - kibanauser - -sg_readall: - readonly: true - backendroles: - - readall - -sg_manage_snapshots: - readonly: true - backendroles: - - snapshotrestore - -sg_own_index: - users: - - '*' \ No newline at end of file diff --git a/src/main/docker/elasticsearch/config/sg/truststore.jks b/src/main/docker/elasticsearch/config/sg/truststore.jks deleted file mode 100644 index 7a1b59a8d24993d19aeda0d1651ce9df702385ed..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 1096 zcmezO_TO6u1_mY|W(3o`Mfv$9y2**U$r*{6c|g%*gFU(?46G4)rUsS_3@l6rP0arc znwXv~U}j=uVq#=8;AP{~YV&CO&dbQi&B|cV*l#FoAjrnWIZ3T^@+X}XMoBT|{q7A_tESBQv$bAGOZXI`?Np`w92NQ#?B0$oZW2S<-O|Fpv(2Ga@$jz4S(kZ6)aDZR%4iLwC_?zl>ZFLP2DeLj?DRVUE{jf zuevBhF1O7(Wm6gySocTIGW*1(eV$9B;`;0vTTFg#{NEb(rIT}K=b}Fjb1T;czF%~J zJvXWSr1ruflS&D9_R!+oM%!-7dj|7DSU(*X&**Xg65JJ`^Q1v#>CNO<+zYwBbZ*?d z_~OrH1uj$8{NZA7e<&F^zr*kL^@%T@I81O~v;2y}qg_#cdfAD~_uNU(_{eU)eyed@ zwDF7CzFS)sZke}dh5S?|W=00a#mNSV27JKuA$^-_(6PO5TDh68Aut( zf&}z_U`{Tr)P0b&I|nr_sKF41*b1rWflnou?Fl4P*XQB8W&mqSg(_*WGTVCEAIq&SU!A5i zKTa;{_@z8?`>odZ{nzR@E!O!J>0Z2Kf^W{+uM4@(oIUGM!g1io{qDaxEn(Yi-iNXr zGP$|ec0t*elL9jz?dy3`eVR$v+J9M>tv;{P_T0o(e%l`~mZ~o`;;7pqlOFw=k5@I> eG{HGy@~6JmhcBkqNFSY0=&xpc>Cc;)T}A+=vX}z^ diff --git a/src/main/docker/elasticsearch/my-entrypoint.sh b/src/main/docker/elasticsearch/my-entrypoint.sh index 9eee64e0..50021b41 100644 --- a/src/main/docker/elasticsearch/my-entrypoint.sh +++ b/src/main/docker/elasticsearch/my-entrypoint.sh @@ -1,8 +1 @@ -source init_sg.sh - -while [ $? -ne 0 ]; do - sleep 10 - source init_sg.sh -done & - /bin/bash -c "source /usr/local/bin/docker-entrypoint.sh;" diff --git a/src/main/docker/kibana/Dockerfile b/src/main/docker/kibana/Dockerfile index 21e89252..9962fe31 100644 --- a/src/main/docker/kibana/Dockerfile +++ b/src/main/docker/kibana/Dockerfile @@ -23,11 +23,8 @@ FROM docker.elastic.co/kibana/kibana-oss:6.6.2 -# Search Guard plugin -RUN kibana-plugin install https://repo1.maven.org/maven2/com/floragunn/search-guard-kibana-plugin/6.6.2-18.4/search-guard-kibana-plugin-6.6.2-18.4.zip - MAINTAINER "The Onap Team" -LABEL Description="Kibana image with saved objects loading and Search Guard support" +LABEL Description="Kibana image with saved objects loading" USER root RUN yum install -y python-requests && yum clean all diff --git a/src/main/docker/kibana/conf/kibana.yml b/src/main/docker/kibana/conf/kibana.yml index cfec41e3..668f8060 100644 --- a/src/main/docker/kibana/conf/kibana.yml +++ b/src/main/docker/kibana/conf/kibana.yml @@ -8,10 +8,7 @@ server.ssl.enabled: true server.ssl.key: /usr/share/kibana/config/keystore/org.onap.clamp.key.pem server.ssl.certificate: /usr/share/kibana/config/keystore/org.onap.clamp.crt.pem -## Search Guard # #xpack.security.enabled: false elasticsearch.username: kibanaserver elasticsearch.password: kibanaserver - -searchguard.cookie.password: 123567818187654rwrwfsfshdhdhtegdhfzftdhncn \ No newline at end of file -- 2.16.6