Warn users if security is implicitly disabled #70114
Conversation
Elasticsearch has security features implicitly disabled by default for Basic and Trial licenses, unless explicitly set in the configuration file. This may be good for onboarding, but it also lead to unintended insecure clusters. This change introduces clear warnings when security features are implicitly disabled. - a warning header in each REST response if security is implicitly disabled; - a log message during cluster boot.
|
@elasticmachine update branch |
|
merge conflict between base and head |
|
Pinging @elastic/es-security (Team:Security) |
|
@elasticmachine update branch |
|
@elasticmachine update branch |
|
@elasticmachine update branch |
|
@elasticmachine update branch |
|
@elasticmachine update branch |
| HeaderWarning.addWarning("Elasticsearch built-in security features are not enabled, your cluster may be accessible " + | ||
| "without authentication. Read https://www.elastic.co/guide/en/elasticsearch/reference/" + Version.CURRENT.major + "." + | ||
| Version.CURRENT.minor + "/get-started-enable-security.html for more information"); | ||
| } |
There was a problem hiding this comment.
Have we checked with the docs team (maybe @lockewritesdocs ?) about whether we should point directly to this URL?
It might be better to have a redirect in place and link to that - I don't know, they're the experts.
Whatever we put here is likely to need to be maintained for 2+ years, while 7.x is still a supported version, so we should take a few minutes to make the best possible choice.
There was a problem hiding this comment.
I'll try to find out
There was a problem hiding this comment.
The linked page was removed as part of the recent security documentation overhaul. However, there is a redirect in place to Set up minimal security for the Elastic Stack, so I would use that link instead.
Hardcoded links can be brittle, but if the page is moved or changed, we implement redirects like the one for the get-started-enable-security.html page. The Kibana team uses a link service to manage doc links instead of hardcoding them, but that's a much heavier lift than adding a single link.
...ity/src/main/java/org/elasticsearch/xpack/security/support/SecurityStatusChangeListener.java
Show resolved
Hide resolved
|
@elasticmachine update branch |
There was a problem hiding this comment.
@BigPandaToo, I added a suggested change to update the doc link and slightly modified the language.
| HeaderWarning.addWarning("Elasticsearch built-in security features are not enabled, your cluster may be accessible " + | ||
| "without authentication. Read https://www.elastic.co/guide/en/elasticsearch/reference/" + Version.CURRENT.major + "." + | ||
| Version.CURRENT.minor + "/get-started-enable-security.html for more information"); |
There was a problem hiding this comment.
| HeaderWarning.addWarning("Elasticsearch built-in security features are not enabled, your cluster may be accessible " + | |
| "without authentication. Read https://www.elastic.co/guide/en/elasticsearch/reference/" + Version.CURRENT.major + "." + | |
| Version.CURRENT.minor + "/get-started-enable-security.html for more information"); | |
| containsString("Elasticsearch built-in security features are not enabled. Without authentication, your cluster could be accessible " + | |
| "to anyone. See https://www.elastic.co/guide/en/elasticsearch/reference/" + Version.CURRENT.major + "." + | |
| Version.CURRENT.minor + "/security-minimal-setup.html to enable security.")); |
There was a problem hiding this comment.
I updated the link with this suggested change and also modified the language a bit. Let me know if those changes are 👍
|
@elasticmachine update branch |
|
@elasticmachine update branch |
* Warn users if security is implicitly disabled Elasticsearch has security features implicitly disabled by default for Basic and Trial licenses, unless explicitly set in the configuration file. This may be good for onboarding, but it also lead to unintended insecure clusters. This change introduces clear warnings when security features are implicitly disabled. - a warning header in each REST response if security is implicitly disabled; - a log message during cluster boot.
* Warn users if security is implicitly disabled (#70114) Elasticsearch has security features implicitly disabled by default for Basic and Trial licenses, unless explicitly set in the configuration file. This may be good for onboarding, but it also lead to unintended insecure clusters. This change introduces clear warnings when security features are implicitly disabled. - a warning header in each REST response if security is implicitly disabled; - a log message during cluster boot.
|
In retrospect this would have been a good candidate for our |
is enabled in this cluster).
Elasticsearch has security features implicitly disabled by default for
Basic and Trial licenses, unless explicitly set in the configuration
file.
This may be good for onboarding, but it also lead to unintended insecure
clusters.
This change introduces clear warnings when security features are
implicitly disabled.
disabled;