Securing Graylog/ElasticCluster with Readonlyrest

piellick · February 25, 2019, 10:47am

Title: Securing Graylog/ElasticCluster with Readonlyrest

Hy everyone, someone as already use readonlyRest to secure connection between raylog and an Elasticsearch cluster ?
Present the shiny final result (screenshot helps)

List the ingredients:

Elasticsearch cluster in 6.X
Graylog 2.5 ou 3.X

Not so much information on graylog side … only that :

github.com/Graylog2/graylog2-server

Unix Authentication

opened 12:43PM - 24 Apr 18 UTC

closed 10:14AM - 28 May 18 UTC

Tajjar

feature triaged

Currently graylog supports only basic authentication when trying to connect to e…lasticsearch. ## Expected Behavior On the elasticsearch side one might set unix authentication using readonlyrest plugin or any type of hashed authentication which is not entirely useful when using it in combination with graylog. ## Current Behavior graylog should be compatible with different authentication types when it comes to communicating with elasticsearch, as it is not a good practice to have the password in plaintext in the configuration file, rather it should be provided as a hashed version of the password. ## Context Having the GDPR on the way, all companies are becoming more serious about having maximum security and privacy in place, especially when it comes to dealing with sensitive data. For that reason, it is necessary to have any credentials hashed and salted as basic authentication isn't a good option compared to other authentication forms. ## Environment * Graylog Version: 2.3.2 * Elasticsearch Version: 5.5.1 * MongoDB Version: 3.4.10 * Operating System: ubuntu 16.04

piellick · March 4, 2019, 11:17am

hi,

nobody did that ?