Deprecate kibana user in favor of kibana_system user #63186

legrego · 2020-04-09T19:59:10Z

This updates the User Grid page and Edit User page to warn about deprecated users. Support for deprecated users was added to Elasticsearch in elastic/elasticsearch#54967, and is used to denote that the kibana user is deprecated in favor of the kibana_system user.

Companion PRs:
elastic/stack-docs#991
elastic/elasticsearch#54967

Resolves #25879

elasticmachine · 2020-04-28T16:37:51Z

Pinging @elastic/kibana-security (Team:Security)

jportner

EDIT: tested locally and works great! A few nits aside from the changes you directly made... (using permalinks to the current HEAD in master so they render properly in my comment)

In Additional validation for elasticsearch username #48247 we deprecated using the elastic user in config in favor of using the kibana user. I'm thinking we should probably change that to deprecate it in favor of kibana_system too. This is in a few files...

kibana/src/core/server/elasticsearch/elasticsearch_config.ts

Lines 132 to 136 in 129cf4f

    
           if (es.username === 'elastic') { 
        
             log( 
        
               `Setting [${fromPath}.username] to "elastic" is deprecated. You should use the "kibana" user instead.` 
        
             ); 
        
           }

kibana/x-pack/plugins/monitoring/server/config.ts

Lines 119 to 124 in 129cf4f

    
           if (rawConfig === 'elastic') { 
        
             return ( 
        
               'value of "elastic" is forbidden. This is a superuser account that can obfuscate ' + 
        
               'privilege-related issues. You should use the "kibana" user instead.' 
        
             ); 
        
           }

kibana/x-pack/plugins/monitoring/server/deprecations.ts

Lines 60 to 64 in 129cf4f

    
           if (es.username === 'elastic') { 
        
             logger( 
        
               `Setting [${fromPath}.username] to "elastic" is deprecated. You should use the "kibana" user instead.` 
        
             ); 
        
           }

Should we update this functional test assertion for the kibana_system user instead?

kibana/x-pack/test/functional/apps/security/users.js

Lines 28 to 29 in 129cf4f

    
           expect(users.kibana.roles).to.eql(['kibana_system']); 
        
           expect(users.kibana.reserved).to.be(true);

This is really nitpicky, but do we want to change the wording from "kibana user" to "Kibana user" to differentiate the intent from the username itself? Or split this into two messages for the kibana and kibana_system users? 😛 I don't feel super strongly about it, just wanted to point it out in case you missed it.

kibana/x-pack/plugins/security/public/management/users/edit_user/edit_user_page.tsx

Line 257 in 129cf4f

    
           defaultMessage="After you change the password for the kibana user, you must update the {kibana}

I found a few more references to the deprecated kibana user:

kibana/x-pack/README.md

Line 15 in 129cf4f

    
           By default, this will also set the password for native realm accounts to the password provided (`changeme` by default). This includes that of the `kibana` user which `elasticsearch.username` defaults to in development. If you wish to specific a password for a given native realm account, you can do that like so: `--password.kibana=notsecure`

kibana/docs/user/security/securing-kibana.asciidoc

Line 41 in 129cf4f

The password for the built-in `kibana` user is typically set as part of the

kibana/x-pack/legacy/plugins/monitoring/README.md

Line 77 in 129cf4f

username: "kibana"

kibana/packages/kbn-es/src/utils/native_realm.test.js

Lines 191 to 209 in 129cf4f

    
               kibana: { 
        
                 metadata: { 
        
                   _reserved: true, 
        
                 }, 
        
               }, 
        
               non_native: { 
        
                 metadata: { 
        
                   _reserved: false, 
        
                 }, 
        
               }, 
        
               logstash_system: { 
        
                 metadata: { 
        
                   _reserved: true, 
        
                 }, 
        
               }, 
        
             }, 
        
           })); 
        
           expect(await nativeRealm.getReservedUsers()).toEqual(['kibana', 'logstash_system']);

There were a couple more in code comments, but those don't matter as much IMO.

jportner · 2020-04-29T02:32:16Z

x-pack/plugins/security/public/management/users/users_grid/users_grid_page.test.tsx

+          metadata: {
+            _reserved: true,
+            _deprecated: true,
+            _deprecated_reason: 'This user is not cool anymore.',


x-pack/plugins/security/public/management/users/edit_user/edit_user_page.tsx

jportner · 2020-04-29T02:39:33Z

x-pack/plugins/security/public/management/users/user_utils.ts

+export const getExtendedUserDeprecationNotice = (user: User) => {
+  const reason = user.metadata?._deprecated_reason ?? '';
+  return i18n.translate('xpack.security.management.users.extendedUserDeprecationNotice', {
+    defaultMessage: `The {username} user is deprecated. {reason}`,


Perhaps this should change so it will be consistent with the reason?

Suggested change

defaultMessage: `The {username} user is deprecated. {reason}`,

defaultMessage: `The [{username}] user is deprecated. {reason}`,

The current text is consistent with the deprecation message we display for roles today. Gail had actually requested that we remove the brackets from the reason when we did the role deprecations, but then that change would have been inconsistent with the rest of the messages in ES. Overall, I'm 🤷‍♂️ about it, I could go either way.

Given my beautiful backstory, which would you prefer? I'll defer to you 😄

pgayvallet

LGTM for config/kibana.yml changes

legrego · 2020-04-29T10:40:29Z

@jportner thanks for the review! I'm not sure how my search missed those other references, so good looking out 🥇

…ort-deprecated-users

jportner

Sorry, I could have been clearer in my last comment, a couple more suggestions!

src/core/server/elasticsearch/elasticsearch_config.ts

x-pack/plugins/monitoring/server/deprecations.ts

tylersmalley

Operations changes to kbn-es LGTM

Co-authored-by: Joe Portner <5295965+jportner@users.noreply.github.com>

…ort-deprecated-users

legrego · 2020-05-02T23:03:22Z

@elasticmachine merge upstream

legrego · 2020-05-04T14:49:19Z

@elasticmachine merge upstream

legrego · 2020-05-05T00:11:42Z

@jportner ready for another look whenever you get a chance

jportner

LGTM

x-pack/README.md

Co-authored-by: Joe Portner <5295965+jportner@users.noreply.github.com>

legrego · 2020-05-05T13:50:02Z

@elasticmachine merge upstream

kibanamachine · 2020-05-05T15:36:09Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request
Commit: a180339

History

💔 Build #45464 failed 4055603
💚 Build #45033 succeeded 2957424
💛 Build #44782 was flaky dd5c950
💔 Build #44777 failed 33a7f52
💔 Build #44742 failed d424da4

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

legrego mentioned this pull request Apr 9, 2020

Deprecate the kibana reserved user; introduce kibana_system user elastic/elasticsearch#54967

Merged

deprecate kibana user in favor of kibana_system user

03662f2

legrego force-pushed the security/support-deprecated-users branch from bfb081d to 03662f2 Compare April 28, 2020 15:07

add warning to edit user page

4481525

legrego added Feature:Security/Authentication Platform Security - Authentication release_note:deprecation Team:Security Team focused on: Auth, Users, Roles, Spaces, Audit Logging, and more! v7.8.0 v8.0.0 labels Apr 28, 2020

legrego marked this pull request as ready for review April 28, 2020 17:05

legrego requested review from a team as code owners April 28, 2020 17:05

jportner reviewed Apr 29, 2020

View reviewed changes

pgayvallet approved these changes Apr 29, 2020

View reviewed changes

legrego added 2 commits April 29, 2020 06:59

Review 1: Address feedback

688d894

Merge branch 'master' of github.com:elastic/kibana into security/supp…

534cc89

…ort-deprecated-users

legrego requested a review from a team as a code owner April 29, 2020 11:00

legrego requested a review from a team April 29, 2020 11:00

fix translations

85b37de

jportner reviewed Apr 29, 2020

View reviewed changes

src/core/server/elasticsearch/elasticsearch_config.ts Show resolved Hide resolved

x-pack/plugins/monitoring/server/deprecations.ts Show resolved Hide resolved

tylersmalley approved these changes Apr 29, 2020

View reviewed changes

legrego and others added 3 commits May 1, 2020 06:45

Apply suggestions from code review

d424da4

Co-authored-by: Joe Portner <5295965+jportner@users.noreply.github.com>

test deprecation logging when kibana user is specified

26470fb

Merge branch 'master' of github.com:elastic/kibana into security/supp…

33a7f52

…ort-deprecated-users

Merge branch 'master' into security/support-deprecated-users

dd5c950

Merge branch 'master' into security/support-deprecated-users

2957424

legrego requested a review from jportner May 5, 2020 00:11

jportner approved these changes May 5, 2020

View reviewed changes

x-pack/README.md Outdated Show resolved Hide resolved

Update x-pack/README.md

4055603

Co-authored-by: Joe Portner <5295965+jportner@users.noreply.github.com>

Merge branch 'master' into security/support-deprecated-users

a180339

legrego merged commit 6a6deef into elastic:master May 5, 2020

legrego deleted the security/support-deprecated-users branch May 5, 2020 15:36

legrego mentioned this pull request May 5, 2020

[7.x] Deprecate kibana user in favor of kibana_system user (#63186) #65285

Merged

legrego added a commit to legrego/kibana that referenced this pull request May 5, 2020

Deprecate kibana user in favor of kibana_system user (elastic#63186)

06e037e

legrego added a commit that referenced this pull request May 5, 2020

Deprecate kibana user in favor of kibana_system user (#63186) (#65285)

84ecd64

This was referenced Aug 31, 2021

Security usage data #110532

Closed

Security usage data #110548

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Deprecate kibana user in favor of kibana_system user #63186

Deprecate kibana user in favor of kibana_system user #63186

legrego commented Apr 9, 2020 •

edited

Loading

elasticmachine commented Apr 28, 2020

jportner left a comment •

edited

Loading

jportner Apr 29, 2020

jportner Apr 29, 2020

legrego May 1, 2020

pgayvallet left a comment

legrego commented Apr 29, 2020

jportner left a comment

tylersmalley left a comment

legrego commented May 2, 2020

legrego commented May 4, 2020

legrego commented May 5, 2020

jportner left a comment

legrego commented May 5, 2020

kibanamachine commented May 5, 2020

	if (es.username === 'elastic') {
	log(
	`Setting [${fromPath}.username] to "elastic" is deprecated. You should use the "kibana" user instead.`
	);
	}

	if (rawConfig === 'elastic') {
	return (
	'value of "elastic" is forbidden. This is a superuser account that can obfuscate ' +
	'privilege-related issues. You should use the "kibana" user instead.'
	);
	}

	if (es.username === 'elastic') {
	logger(
	`Setting [${fromPath}.username] to "elastic" is deprecated. You should use the "kibana" user instead.`
	);
	}

	expect(users.kibana.roles).to.eql(['kibana_system']);
	expect(users.kibana.reserved).to.be(true);

	kibana: {
	metadata: {
	_reserved: true,
	},
	},
	non_native: {
	metadata: {
	_reserved: false,
	},
	},
	logstash_system: {
	metadata: {
	_reserved: true,
	},
	},
	},
	}));

	expect(await nativeRealm.getReservedUsers()).toEqual(['kibana', 'logstash_system']);

	defaultMessage: `The {username} user is deprecated. {reason}`,
	defaultMessage: `The [{username}] user is deprecated. {reason}`,

Deprecate kibana user in favor of kibana_system user #63186

Deprecate kibana user in favor of kibana_system user #63186

Conversation

legrego commented Apr 9, 2020 • edited Loading

elasticmachine commented Apr 28, 2020

jportner left a comment • edited Loading

Choose a reason for hiding this comment

jportner Apr 29, 2020

Choose a reason for hiding this comment

jportner Apr 29, 2020

Choose a reason for hiding this comment

legrego May 1, 2020

Choose a reason for hiding this comment

pgayvallet left a comment

Choose a reason for hiding this comment

legrego commented Apr 29, 2020

jportner left a comment

Choose a reason for hiding this comment

tylersmalley left a comment

Choose a reason for hiding this comment

legrego commented May 2, 2020

legrego commented May 4, 2020

legrego commented May 5, 2020

jportner left a comment

Choose a reason for hiding this comment

legrego commented May 5, 2020

kibanamachine commented May 5, 2020

💚 Build Succeeded

History

legrego commented Apr 9, 2020 •

edited

Loading

jportner left a comment •

edited

Loading