Skip to content

Commit 9230b00

Browse files
leanneeliatracwperksvagimeliNaarcha-AWSnatebower
authored
Enhancing Security configuration steps (opensearch-project#8058)
* wip building out the security configuration steps Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com> * adding relevant links to docs. Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com> * adding further info to security settings Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com> * reviewdog issues fixed Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com> * paths given for 1.0 securityadmin Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com> * Reconfiguring layout Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com> * updating security configuraton Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com> * Update _security/configuration/index.md Co-authored-by: Craig Perkins <craig5008@gmail.com> Signed-off-by: leanneeliatra <131779422+leanneeliatra@users.noreply.github.com> * Updates for examples given in config doc. Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com> Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com> * Add doc review Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> * Update index.md Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> * Delete _security/configuration/test Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> * Apply suggestions from code review Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> * Made the securityadmin.sh backup tool instructions clearer Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com> Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com> * Apply suggestions from code review Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> * Update _security/configuration/index.md Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> * Apply suggestions from code review Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> * Apply suggestions from code review Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> * updating the command for the securityadmin tool Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com> * reviewdog updates Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com> * Apply suggestions from code review Co-authored-by: Nathan Bower <nbower@amazon.com> Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Nathan Bower <nbower@amazon.com> Signed-off-by: leanneeliatra <131779422+leanneeliatra@users.noreply.github.com> * removing headings as links Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com> * Updating headings to be headings and adding extra links at the end of the text, as is the standard (not to have hyperlinked headings). Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com> * Apply suggestions from code review Co-authored-by: Nathan Bower <nbower@amazon.com> Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> * Update index.md Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> * Apply suggestions from code review Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> --------- Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com> Signed-off-by: leanneeliatra <131779422+leanneeliatra@users.noreply.github.com> Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> Co-authored-by: Craig Perkins <craig5008@gmail.com> Co-authored-by: Melissa Vagi <vagimeli@amazon.com> Co-authored-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> Co-authored-by: Nathan Bower <nbower@amazon.com>
1 parent 81a1355 commit 9230b00

File tree

1 file changed

+97
-13
lines changed

1 file changed

+97
-13
lines changed

_security/configuration/index.md

+97-13
Original file line numberDiff line numberDiff line change
@@ -3,29 +3,113 @@ layout: default
33
title: Configuration
44
nav_order: 2
55
has_children: true
6-
has_toc: false
6+
has_toc: true
77
redirect_from:
88
- /security-plugin/configuration/
99
- /security-plugin/configuration/index/
1010
---
1111

1212
# Security configuration
1313

14-
The plugin includes demo certificates so that you can get up and running quickly. To use OpenSearch in a production environment, you must configure it manually:
14+
The Security plugin includes demo certificates so that you can get up and running quickly. To use OpenSearch with the Security plugin in a production environment, you must make changes to the demo certificates and other configuration options manually.
1515

16-
1. [Replace the demo certificates]({{site.url}}{{site.baseurl}}/install-and-configure/install-opensearch/docker/#configuring-basic-security-settings).
17-
1. [Reconfigure `opensearch.yml` to use your certificates]({{site.url}}{{site.baseurl}}/security/configuration/tls).
18-
1. [Reconfigure `config.yml` to use your authentication backend]({{site.url}}{{site.baseurl}}/security/configuration/configuration/) (if you don't plan to use the internal user database).
19-
1. [Modify the configuration YAML files]({{site.url}}{{site.baseurl}}/security/configuration/yaml).
20-
1. If you plan to use the internal user database, [set a password policy in `opensearch.yml`]({{site.url}}{{site.baseurl}}/security/configuration/yaml/#opensearchyml).
21-
1. [Apply changes using the `securityadmin` script]({{site.url}}{{site.baseurl}}/security/configuration/security-admin).
22-
1. Start OpenSearch.
23-
1. [Add users, roles, role mappings, and tenants]({{site.url}}{{site.baseurl}}/security/access-control/index/).
16+
## Replace the demo certificates
2417

25-
If you don't want to use the plugin, see [Disable security]({{site.url}}{{site.baseurl}}/security/configuration/disable-enable-security/).
18+
OpenSearch ships with demo certificates intended for quick setup and demonstration purposes. For a production environment, it's critical to replace these with your own trusted certificates, using the following steps, to ensure secure communication:
2619

27-
The Security plugin has several default users, roles, action groups, permissions, and settings for OpenSearch Dashboards that use kibana in their names. We will change these names in a future release.
20+
1. **Generate your own certificates:** Use tools like OpenSSL or a certificate authority (CA) to generate your own certificates. For more information about generating certificates with OpenSSL, see [Generating self-signed certificates]({{site.url}}{{site.baseurl}}/security/configuration/generate-certificates/).
21+
2. **Store the generated certificates and private key in the appropriate directory:** Generated certificates are typically stored in `<OPENSEARCH_HOME>/config/`. For more information, see [Add certificate files to opensearch.yml]({{site.url}}{{site.baseurl}}/security/configuration/generate-certificates/#add-certificate-files-to-opensearchyml).
22+
3. **Set the following file permissions:**
23+
- Private key (.key files): Set the file mode to `600`. This restricts access so that only the file owner (the OpenSearch user) can read and write to the file, ensuring that the private key remains secure and inaccessible to unauthorized users.
24+
- Public certificates (.crt, .pem files): Set the file mode to `644`. This allows the file owner to read and write to the file, while other users can only read it.
25+
26+
For additional guidance on file modes, see the following table.
27+
28+
| Item | Sample | Numeric | Bitwise |
29+
|-------------|---------------------|---------|--------------|
30+
| Public key | `~/.ssh/id_rsa.pub` | `644` | `-rw-r--r--` |
31+
| Private key | `~/.ssh/id_rsa` | `600` | `-rw-------` |
32+
| SSH folder | `~/.ssh` | `700` | `drwx------` |
33+
34+
For more information, see [Configuring basic security settings]({{site.url}}{{site.baseurl}}/install-and-configure/install-opensearch/docker/#configuring-basic-security-settings).
35+
36+
## Reconfigure `opensearch.yml` to use your certificates
37+
38+
The `opensearch.yml` file is the main configuration file for OpenSearch; you can find the file at `<OPENSEARCH_HOME>/config/opensearch.yml`. Use the following steps to update this file to point to your custom certificates:
39+
40+
In `opensearch.yml`, set the correct paths for your certificates and keys, as shown in the following example:
41+
```
42+
plugins.security.ssl.transport.pemcert_filepath: /path/to/your/cert.pem
43+
plugins.security.ssl.transport.pemkey_filepath: /path/to/your/key.pem
44+
plugins.security.ssl.transport.pemtrustedcas_filepath: /path/to/your/ca.pem
45+
plugins.security.ssl.http.enabled: true
46+
plugins.security.ssl.http.pemcert_filepath: /path/to/your/cert.pem
47+
plugins.security.ssl.http.pemkey_filepath: /path/to/your/key.pem
48+
plugins.security.ssl.http.pemtrustedcas_filepath: /path/to/your/ca.pem
49+
```
50+
For more information, see [Configuring TLS certificates]({{site.url}}{{site.baseurl}}/security/configuration/tls/).
51+
52+
## Reconfigure `config.yml` to use your authentication backend
53+
54+
The `config.yml` file allows you to configure the authentication and authorization mechanisms for OpenSearch. Update the authentication backend settings in `<OPENSEARCH_HOME>/config/opensearch-security/config.yml` according to your requirements.
55+
56+
For example, to use LDAP as your authentication backend, add the following settings:
57+
58+
```
59+
authc:
60+
basic_internal_auth:
61+
http_enabled: true
62+
transport_enabled: true
63+
order: 1
64+
http_authenticator:
65+
type: basic
66+
challenge: true
67+
authentication_backend:
68+
type: internal
69+
```
70+
For more information, see [Configuring the Security backend]({{site.url}}{{site.baseurl}}/security/configuration/configuration/).
71+
72+
## Modify the configuration YAML files
73+
74+
Determine whether any additional YAML files need modification, for example, the `roles.yml`, `roles_mapping.yml`, or `internal_users.yml` files. Update the files with any additional configuration information. For more information, see [Modifying the YAML files]({{site.url}}{{site.baseurl}}/security/configuration/yaml/).
75+
76+
## Set a password policy
77+
78+
When using the internal user database, we recommend enforcing a password policy to ensure that strong passwords are used. For information about strong password policies, see [Password settings]({{site.url}}{{site.baseurl}}/security/configuration/yaml/#password-settings).
79+
80+
## Apply changes using the `securityadmin` script
81+
82+
The following steps do not apply to first-time users because the security index is automatically initialized from the YAML configuration files when OpenSearch starts.
83+
{: .note}
84+
85+
After initial setup, if you make changes to your security configuration or disable automatic initialization by setting `plugins.security.allow_default_init_securityindex` to `false` (which prevents security index initialization from `yaml` files), you need to manually apply changes using the `securityadmin` script:
86+
87+
1. Find the `securityadmin` script. The script is typically stored in the OpenSearch plugins directory, `plugins/opensearch-security/tools/securityadmin.[sh|bat]`.
88+
- Note: If you're using OpenSearch 1.x, the `securityadmin` script is located in the `plugins/opendistro_security/tools/` directory.
89+
- For more information, see [Basic usage](https://opensearch.org/docs/latest/security/configuration/security-admin/#basic-usage).
90+
2. Run the script by using the following command:
91+
```
92+
./plugins/opensearch-security/tools/securityadmin.[sh|bat]
93+
```
94+
3. Check the OpenSearch logs and configuration to ensure that the changes have been successfully applied.
95+
96+
For more information about using the `securityadmin` script, see [Applying changes to configuration files]({{site.url}}{{site.baseurl}}/security/configuration/security-admin/).
97+
98+
## Add users, roles, role mappings, and tenants
99+
100+
If you don't want to use the Security plugin, you can disable it by adding the following setting to the `opensearch.yml` file:
101+
102+
```
103+
plugins.security.disabled: true
104+
```
105+
106+
You can then enable the plugin by removing the `plugins.security.disabled` setting.
107+
108+
For more information about disabling the Security plugin, see [Disable security]({{site.url}}{{site.baseurl}}/security/configuration/disable-enable-security/).
109+
110+
The Security plugin has several default users, roles, action groups, permissions, and settings for OpenSearch Dashboards that contain "Kibana" in their names. We will change these names in a future version.
28111
{: .note }
29112

30-
For a full list of `opensearch.yml` Security plugin settings, Security plugin settings, see [Security settings]({{site.url}}{{site.baseurl}}/install-and-configure/configuring-opensearch/security-settings/).
113+
For a full list of `opensearch.yml` Security plugin settings, see [Security settings]({{site.url}}{{site.baseurl}}/install-and-configure/configuring-opensearch/security-settings/).
31114
{: .note}
115+

0 commit comments

Comments
 (0)