MongoDB password from connection string is indexed in metricset.host field and is visible #2888

cwhenderson20 · 2016-10-31T02:10:23Z

Similar to #2738. When connecting to a running instance of MongoDB, the user and password of the connection string are indexed into the metricset.host field.

However, unlike #2738, I'm not aware of another way to specify the connection string such that the user/pass is separated out.

This prevents us from using the mongodb module as even logging the credentials of a users with minimal permissions is not acceptable.

tsg · 2016-10-31T10:36:50Z

Ah, good point :(. Only workaround for now is to use drop_field to remove the host information. Treating this as high prio.

We previously only had the option of specifying a user/pass in the URL string, which is problematic because it results in the password being indexed in Elasticsearch (elastic#2888). This adds the option to specify a username/password at the module configuration. To make this happen, I had to copy some unexported functions from the mgo driver.

We previously only had the option of specifying a user/pass in the URL string, which is problematic because it results in the password being indexed in Elasticsearch (#2888). This adds the option to specify a username/password at the module configuration. To make this happen, I had to copy some unexported functions from the mgo driver.

ruflin · 2016-10-31T13:17:10Z

Closing as #2889 was merged.

We previously only had the option of specifying a user/pass in the URL string, which is problematic because it results in the password being indexed in Elasticsearch (elastic#2888). This adds the option to specify a username/password at the module configuration. To make this happen, I had to copy some unexported functions from the mgo driver. (cherry picked from commit 6c7dfe4)

We previously only had the option of specifying a user/pass in the URL string, which is problematic because it results in the password being indexed in Elasticsearch (#2888). This adds the option to specify a username/password at the module configuration. To make this happen, I had to copy some unexported functions from the mgo driver. (cherry picked from commit 6c7dfe4)

…lastic#2900) We previously only had the option of specifying a user/pass in the URL string, which is problematic because it results in the password being indexed in Elasticsearch (elastic#2888). This adds the option to specify a username/password at the module configuration. To make this happen, I had to copy some unexported functions from the mgo driver. (cherry picked from commit b4f22e3)

tsg added bug Metricbeat Metricbeat P1 labels Oct 31, 2016

tsg self-assigned this Oct 31, 2016

tsg mentioned this issue Oct 31, 2016

Add explicit username and password option for Mongodb #2889

Merged

ruflin closed this as completed Oct 31, 2016

tsg mentioned this issue Nov 1, 2016

Backport: Add explicit username and password option for Mongodb (#2889) #2900

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

MongoDB password from connection string is indexed in metricset.host field and is visible #2888

MongoDB password from connection string is indexed in metricset.host field and is visible #2888

cwhenderson20 commented Oct 31, 2016

tsg commented Oct 31, 2016

ruflin commented Oct 31, 2016

MongoDB password from connection string is indexed in metricset.host field and is visible #2888

MongoDB password from connection string is indexed in metricset.host field and is visible #2888

Comments

cwhenderson20 commented Oct 31, 2016

tsg commented Oct 31, 2016

ruflin commented Oct 31, 2016