[Fleet] Support preconfigured output secrets (scrypt edition) #172041
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
🤖 GitHub commentsExpand to view the GitHub comments
Just comment with:
|
jillguyonnet
added
Team:Fleet
jillguyonnet
changed the title
| export async function hashSecret(secret: string) { | ||
| return new Promise((resolve, reject) => { | ||
| const salt = crypto.randomBytes(16).toString('hex'); | ||
| crypto.scrypt(secret, salt, 64, { p: 5 }, (err, derivedKey) => { |
There was a problem hiding this comment.
nit: should the integer values be moved to constants?
|
Pinging @elastic/fleet (Team:Fleet) |
This PR adds support for outputs with secrets preconfigured in the `kibana.yml` config file. As Kibana needs to compare the value of the secret to manage updates, a hash of the value is stored in the output's saved object. The implementation follows [option 2 in Infosec's recommendations](elastic/infosec#14853 (comment)) with the Argon2id algorithm. See [here](https://www.npmjs.com/package/argon2) for information about the `argon2` Node package and [here](https://github.com/ranisalt/node-argon2/wiki/Options) for the config options. Here, `argon2` was configured with the recommended `m=19456 (19 MiB), t=2, p=1 ` (for some reason, `timeCost` cannot be set to less than 2). Closes elastic#166360 1. Ensure the [`outputSecretsStorage` experimental feature ](https://github.com/elastic/kibana/blob/fd4fdb01bcb011c0968a4ccab7ba739c3195016a/x-pack/plugins/fleet/common/experimental_features.ts#L26)is enabled. 2. Add the following to your kibana config: ``` xpack.fleet.outputs: - id: my-logstash-output-with-a-secret name: preconfigured logstash output with a secret type: logstash hosts: ["localhost:9999"] ssl: certificate: xxxxxxxxxx secrets: ssl: key: thisissecret ``` 3. Verify the secret has been correctly created, e.g. by issuing a `GET .fleet-secrets/_search` request in Dev Tools: the secret should be listed there. 4. Change the preconfigured value and wait for kibana to restart: the secret should be updated with the new value. --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: jillguyonnet <jill.guyonnet@gmail.com>
jillguyonnet
force-pushed
the
fleet/166360-preconfigured-output-secrets-scrypt
branch
from
fa9fae0
to
0184a8d
Compare
|
@elasticmachine merge upstream |
jillguyonnet
commented
Nov 29, 2023
| | { | ||
| id: string; | ||
| }; | ||
| service_token?: OutputSecret; |
There was a problem hiding this comment.
@juliaElastic Does this look OK? I made this change after #171875 was merged.
There was a problem hiding this comment.
we should test if a preconfigured remote_elasticsearch output works though
|
@elasticmachine merge upstream |
💚 Build Succeeded
Metrics [docs]
History
To update your PR or re-run it, just comment with: |
kpollich
approved these changes
Nov 30, 2023
jillguyonnet
deleted the
fleet/166360-preconfigured-output-secrets-scrypt
branch
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Support for outputs with secrets preconfigured in
kibana.yml. This was already implemented in #170259, which had to be reverted as theargon2package was causing Windows tests to test (cf. this comment).The present implementation follows option 2 in Infosec's recommendations with the Scrypt algorithm using the following params: N=2^14 (16 MiB), r=8 (1024 bytes), p=5. Note that Scrypt is built-in within the
cryptomodule (see here for documentation).Closes #166360
Testing
outputSecretsStorageexperimental feature is enabled.GET .fleet-secrets/_searchrequest in Dev Tools: the secret should be listed there.