Am 25.10.2018 um 20:54 schrieb Jochen Kressin <jkressin@floragunn.com>:
Hi Cameron,
I can confirm this is a bug that was introduced by a change in 23.1 and that surfaces depending on what indices are available on your cluster, and how monitoring is configured.
We are working on a fix at the moment which we can hopefully ship as a snapshot soon. The only known workaround at the moment is to create empty indices for the wildcard checks that Kibana performs when using the Monitoring app, like:
curl -u ... -k -X PUT "https://localhost:9200/.monitoring-beats-6-2018.10.25"
curl -u ... -k -X PUT "https://localhost:9200/.monitoring-logstash-6-2018.10.25"
curl -u ... -k -X PUT "https://localhost:9200/.monitoring-kibana-6-2018.10.25"
curl -u ... -k -X PUT "https://localhost:9200/.reporting-2018.10.25"
curl -u ... -k -X PUT "https://localhost:9200/.monitoring-es-6-2018.10.25"
I know this is not elegant, but until the snapshot has been released this seems to be the only workaround.
On Thursday, October 25, 2018 at 11:57:38 AM UTC+2, Jochen Kressin wrote:
Thanks for reporting this! We need to investigate the behavior here locally. At the moment I don't see how the dnfof setting can affect the access check in the monitoring app. I would have expected it to be the other way round: Access checks fail when dnfof is false, but your test proves otherwise. I will be back once we know what is going on here.
On Thursday, October 25, 2018 at 7:40:13 AM UTC+2, Cam McKenzie wrote:
Ok in an attempt to fix the issue I upgraded my whole stack to Elastic / Kibana 6.4.2 with SearchGuard 23.1 and SearchGuard "6.4.2-15" for Kibana
So here is what I have found out:
Unknowingly to me, when I enabled: ‘do_not_fail_on_forbidden: true’
It broke Kibana Monitoring (https://KIBANASERVER/app/monitoring\)
If ‘do_not_fail_on_forbidden: true’ is set and an administrator tries to access the monitoring they get the following screenshot:
There are no errors reported in Elasticsearch at the time of error.
There are errors reporting in the Kibana log, relating to the error – This is the message:
25/10/2018 13:24:49{"type":"error","@timestamp":"2018-10-25T03:24:49Z","tags":["warning","stats-collection"],"pid":1,"level":"error","error":{"message":"[security_exception] no permissions for [indices:data/read/search] and User [name=kibanaserver, roles=[kibanaserver], requestedTenant=null]","name":"Error","stack":"[security_exception] no permissions for [indices:data/read/search] and User [name=kibanaserver, roles=[kibanaserver], requestedTenant=null] :: {\"path\":\"/.reporting-*/_search\",\"query\":{\"filter_path\":\"hits.total,aggregations.jobTypes.buckets,aggregations.objectTypes.buckets,aggregations.layoutTypes.buckets,aggregations.statusTypes.buckets\"},\"body\":\"{\\\"size\\\":0,\\\"aggs\\\":{\\\"jobTypes\\\":{\\\"terms\\\":{\\\"field\\\":\\\"jobtype\\\",\\\"size\\\":2}},\\\"objectTypes\\\":{\\\"terms\\\":{\\\"field\\\":\\\"meta.objectType.keyword\\\",\\\"size\\\":3}},\\\"layoutTypes\\\":{\\\"terms\\\":{\\\"field\\\":\\\"meta.layout.keyword\\\",\\\"size\\\":3}},\\\"statusTypes\\\":{\\\"terms\\\":{\\\"field\\\":\\\"status\\\",\\\"size\\\":4}}}}\",\"statusCode\":403,\"response\":\"{\\\"error\\\":{\\\"root_cause\\\":[{\\\"type\\\":\\\"security_exception\\\",\\\"reason\\\":\\\"no permissions for [indices:data/read/search] and User [name=kibanaserver, roles=[kibanaserver], requestedTenant=null]\\\"}],\\\"type\\\":\\\"security_exception\\\",\\\"reason\\\":\\\"no permissions for [indices:data/read/search] and User [name=kibanaserver, roles=[kibanaserver], requestedTenant=null]\\\"},\\\"status\\\":403}\"}\n at respond (/usr/share/kibana/node_modules/elasticsearch/src/lib/transport.js:307:15)\n at checkRespForFailure (/usr/share/kibana/node_modules/elasticsearch/src/lib/transport.js:266:7)\n at HttpConnector.<anonymous> (/usr/share/kibana/node_modules/elasticsearch/src/lib/connectors/http.js:159:7)\n at IncomingMessage.bound (/usr/share/kibana/node_modules/elasticsearch/node_modules/lodash/dist/lodash.js:729:21)\n at emitNone (events.js:111:20)\n at IncomingMessage.emit (events.js:208:7)\n at endReadableNT (_stream_readable.js:1064:12)\n at _combinedTickCallback (internal/process/next_tick.js:138:11)\n at process._tickCallback (internal/process/next_tick.js:180:9)"},"message":"[security_exception] no permissions for [indices:data/read/search] and User [name=kibanaserver, roles=[kibanaserver], requestedTenant=null]"}
25/10/2018 13:24:49{"type":"log","@timestamp":"2018-10-25T03:24:49Z","tags":["warning","stats-collection"],"pid":1,"message":"Unable to fetch data from reporting collector"}
It seems DIRECTLY related to setting: ‘do_not_fail_on_forbidden: true’ because if I set it to 'false', the monitoring app works correctly.
Can you confirm this bug? How can I fix it?
Thanks
--
You received this message because you are subscribed to the Google Groups "Search Guard Community Forum" group.
To unsubscribe from this group and stop receiving emails from it, send an email to search-guard+unsubscribe@googlegroups.com.
To post to this group, send email to search-guard@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/search-guard/83516836-1413-4a47-bab3-e850bb2bf538%40googlegroups.com\.
For more options, visit https://groups.google.com/d/optout\.
