Restrict auth domain to certain subnet

Search Guard
1

Is it possible to restrict an auth domain to a given CIDR ?
This could for insance be used to prevent the kibanaserver user to use the REST API from outside the organization.
Or is there another way to achieve this ?

2

actually I’m pretty worried about having to enable basic auth: the kibanaserver user can remove all kibana indices

3

I see there’s the new blocking configuration options. That could help, if one could block users from certain net_masks or IPs, which it doesn’t seem to.

4

Yes, you can block by netmask: Main concepts | Security for Elasticsearch | Search Guard. Also, you can use a firewall on the ES servers, for example, iptables if it is Linux.

5

but you can’t block a user from a certain mask only

6

the problem with the kibana user is that it’s granted access from everywhere, while it only needs access from the box running kibana. I don’t want to have world accessible basic auth just because of an Elasticsearch/Kibana limitation

7

You can allow the connection only from a secure subnet, for example

a_secure_subnet:
  type: "net_mask"
  value: ["192.168.1.0/24"]
  verdict: "allow"
8

but that will be effective for all users, not just the kibana server user

9

Just a quick update on this topic:

This feature is now available since Search Guard 47:

2 Likes
10

Thanks so much for this !

11

Hi I just tried this feature, but got an error message while trying to apply the config:

ERR: Seems /opt/search-guard/sgconfig/sg_config.yml is not in SG 7 format: com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException: Unrecognized field "enabled_only_for_ips" (class com.floragunn.searchguard.sgconf.impl.v7.ConfigV7$AuthcDomain), not marked as ignorable (6 known properties: "http_enabled", "transport_enabled", "http_authenticator", "authentication_backend", "order", "description"])

Nodes are all running search-guard-7 7.9.1-47.3.0

12

Here is the corresponding config I was trying to apply:

basic_internal_auth_domain:
  order: 3
  enabled_only_for_ips:
    - 10.0.0.0/16
  http_authenticator:
    type: basic
    challenge: false
  authentication_backend:
    type: intern
13

When do you get the error? If you get it while using sgadmin, please verify that sgadmin is also from SG 47 or above.

14

You’re right, I didn’t upgrade the standalone SG :man_facepalming: