Restrict auth domain to certain subnet

Search Guard
#1

Is it possible to restrict an auth domain to a given CIDR ?
This could for insance be used to prevent the kibanaserver user to use the REST API from outside the organization.
Or is there another way to achieve this ?

#2

actually I’m pretty worried about having to enable basic auth: the kibanaserver user can remove all kibana indices

#3

I see there’s the new blocking configuration options. That could help, if one could block users from certain net_masks or IPs, which it doesn’t seem to.

#4

Yes, you can block by netmask: https://docs.search-guard.com/latest/main-concepts#block-user--ip-addressnet-mask. Also, you can use a firewall on the ES servers, for example, iptables if it is Linux.

#5

but you can’t block a user from a certain mask only

#6

the problem with the kibana user is that it’s granted access from everywhere, while it only needs access from the box running kibana. I don’t want to have world accessible basic auth just because of an Elasticsearch/Kibana limitation

#7

You can allow the connection only from a secure subnet, for example

a_secure_subnet:
  type: "net_mask"
  value: ["192.168.1.0/24"]
  verdict: "allow"
#8

but that will be effective for all users, not just the kibana server user

#9

Just a quick update on this topic:

This feature is now available since Search Guard 47:

2 Likes
#10

Thanks so much for this !