No permission in version 7.2

Search Guard
1

I’m using v7.2, seems older version config file not the same as v7.2

sg_internal_uses.yml:

logstash:
  hash: "$2y$12$ZMZ4MM82Pjdi38R.UettceWdvZZMyB5sowlymi18ZJ.B75gfVXM.G"
  reserved: false
  backend_roles:
  - "logstash"
  description: "Demo logstash user"

sg_roles_mapping.yml:

SGS_LOGSTASH:
  reserved: false
  backend_roles:
  - "logstash"
...
PA_LOGSTASH_USER:
  reserved: true
  backend_roles:
  - "logstash"

sg_roles.yml:

PA_LOGSTASH_USER:
  description: "my search guard role"
  cluster_permissions:
    - "cluster:monitor/main"
    - "cluster:admin/xpack/monitoring/bulk"
    - CLUSTER_MONITOR
    - CLUSTER_COMPOSITE_OPS
    - CLUSTER_MANAGE_INDEX_TEMPLATES
    - CLUSTER_MANAGE_ILM
    - CLUSTER_MANAGE_PIPELINES
  index_permissions:
    - index_patterns:
      - "panos-*"
      allowed_actions:
        - SGS_READ
        - SGS_WRITE

My logstash got error:

retrying failed action with response code: 403 ({"type"=>"security_exception", "reason"=>"no permissions for [indices:data/write/index, indices:data/write/bulk[s]] and User [name=logstash, roles=[logstash], requestedTenant=null]"})

What did I missed here? Thanks

3

Hi,

can you please post the content of the Elasticsearch logs when this error happens. It should contain more information than the logstash output.

4

@jkressin Hi, here is elasticsearch log:

{"type": "server", "timestamp": "2019-07-16T01:20:01,290+0000", "level": "INFO", "component": "c.f.s.p.PrivilegesEvaluator", "cluster.name": "docker-cluster", "node.name": "es01", "cluster.uuid": "xh55E4cWQh2-i3kLoYVOtw", "node.id": "wq-gu1R1SACeIv6V6agciw", "message": "No index-level perm match for User [name=logstash, roles=[logstash], requestedTenant=null] Resolved [aliases=[], indices=[panos-traffic], allIndices=[panos-traffic], types=[*], originalRequested=[panos-traffic], remoteIndices=[]] [Action [indices:data/write/bulk[s]]] [RolesChecked [SGS_LOGSTASH, SGS_OWN_INDEX]]" }

Seems my customized role not checked?

5

Did you push your config (after editing) via sgadmin into the cluster?

6

Thanks, use sgadmin push config solved this problem.