Skip to content
This repository has been archived by the owner on Apr 19, 2021. It is now read-only.

Commit

Permalink
Browse files Browse the repository at this point in the history
  • Loading branch information
dougburks committed Jul 18, 2019
1 parent 3c6081c commit 8807669
Showing 1 changed file with 8 additions and 3 deletions.
11 changes: 8 additions & 3 deletions usr/sbin/so-elastic-auth
Expand Up @@ -120,6 +120,7 @@ curl -uelastic:$ELASTICSEARCH_PASSWORD -X POST "$ELASTICSEARCH_HOST:$ELASTICSEAR
]
}
'
echo

echo "Creating so_pcap user and giving it the so_pcap role..."
SO_PCAP_PASSWORD_1=$(mkpasswd -s 0)
Expand All @@ -131,6 +132,7 @@ curl -uelastic:$ELASTICSEARCH_PASSWORD -X POST "$ELASTICSEARCH_HOST:$ELASTICSEAR
\"roles\" : [ \"so_pcap\" ]
}
"
echo

echo "Configuring CapMe for so_pcap user..."
touch $ELASTICSEARCH_PCAP
Expand All @@ -154,18 +156,21 @@ curl -uelastic:$ELASTICSEARCH_PASSWORD -X POST "$ELASTICSEARCH_HOST:$ELASTICSEAR
]
}
'
echo

mysql --defaults-file=/etc/mysql/debian.cnf -Dsecurityonion_db -N -e 'select username from user_info where username != "auto" and password != "LOCKED";' | while read USER; do
echo "Exporting list of Sguil user accounts and creating corresponding Elastic accounts with role set as so_user_read_only..."
mysql --defaults-file=/etc/mysql/debian.cnf -Dsecurityonion_db -N -e 'select username from user_info where username != "auto" and password != "LOCKED";' | while read USERNAME; do
PASSWORD_1=$(mkpasswd -s 0)
PASSWORD_2=$(mkpasswd -s 0)
PASSWORD="${PASSWORD_1}${PASSWORD_2}"
echo "Creating Elastic user account for $USER with password $PASSWORD and setting role as so_user_read_only..."
curl -uelastic:$ELASTICSEARCH_PASSWORD -X POST "$ELASTICSEARCH_HOST:$ELASTICSEARCH_PORT/_xpack/security/user/$USER" -H 'Content-Type: application/json' -d"
echo "Username: $USERNAME Password: $PASSWORD"
curl -uelastic:$ELASTICSEARCH_PASSWORD -X POST "$ELASTICSEARCH_HOST:$ELASTICSEARCH_PORT/_xpack/security/user/$USERNAME" -H 'Content-Type: application/json' -d"
{
\"password\" : \"$PASSWORD\",
\"roles\" : [ \"so_user_read_only\" ]
}
"
echo

done

Expand Down

0 comments on commit 8807669

Please sign in to comment.