Opensearch (under Datanode) reachable with default user admin/admin; how to fix this?

Graylog Central (peer support)
1

Hello,

after the successful migration from opensearch 1.3.20 to Graylog Datanode 7.1.7 we found out, that the opensearch nodes are reachable on port 9200 (with self-signed certificates).

That’s not the probelm, but one can login with the default credentials (admin/admin). How to fix this?

The defined passwort in datanode.conf is not “admin”.

Do I need to configure local firewall rules (with ufw) to disable access to this port?

Regards,

Dietmar

OS Information: RHEL 8

Package Version: Graylog 7.1.7

2

Hi @schurd ,

There are several things happening in your setup.

Opensearch inside datanode should never be accessible with username/password only. The only two auth methods that are configured are JWT and client certs. You are talking about self-signed certificates, so I assume you are using the graylog self-signed CA, that assigned certificates to datanodes. I also assume you haven’t disabled the security anyhow, right?

The 9200 port is the standard opensearch port that’s open for graylog server-opensearch communication. This needs to be accessible from the datanode and graylog server, can be blocked from elsewhere.

datanode.conf doesn’t provide any password to the opensearch, so anything you configured there (under which key?) won’t be used anyhow.

3

Hello Tomas,

yes, we just had the assisted migration with no special action (self-signed CA).

In the datanode.conf we have:

password_secret = b7887c1757450f87eeb2684ecd8a8205b0a0487d7c08b88e97b02fcf2e7d66d3

root_username = admin

root_password_sha2 = aca07d3e4eacfb4bc151b9e47758563ec8b49507857048019b694cb0f7033f72

The certificate values are commented out

# transport_certificate = datanode-transport-certificates.p12
# transport_certificate_password = password
# http_certificate = datanode-http-certificates.p12
# http_certificate_password = password

Will there be a Graylog solution to improve this security issue, or should we just use a local firewall (iptables) to allow only specific IP addresses (the other nodes) and block all other IP adresses?

How can we disable the user admin/admin, without being re-enabled at the next Graylog Datanode update?

What is your recommendation?

Thanks in advance.

Regards,

Dietmar Schurr

4

Hi Dietmar,
Currently I don’t think there is any security issue. The exposed 9200 port is the standard, both for plain opensearch and for opensearch-in-datanode. Limiting access from outside is never a bad idea. You can also reconfigure the `bind_address` if you want your datanode and opensearch to listen only on some specific internal address.

`password_secret` is the password used to access shared mongodb instance. This isn’t used anyhow for opensearch.

Both `root_username` and `root_password_sha2` properties are dead and not used anyhow. You can remove/comment out these.

Back to the admin/admin issue. I strongly suspect that this is a leftover from your migrated opensearch 1.3 setup, where the basic auth is stuck in the security configuration in one of the config indices in opensearch. You had probably this configured before and datanode imported this configuration together with other data, during the migration. Does it sound plausible? In opensearch, can you check _plugins/_security/api/securityconfig to verify what runtime security configuration you see there?

Look for something like

"http_authenticator": { "type": "basic" }

During the migration, you adapted the existing security configuration file. Does this contain any basic auth?

If we verify that basic auth is present and enabled in the runtime configuration, we can craft a command that would remove it from there and disable it.

5

Hello Tomas,

yes, in the curl response has six times the phrase “http_authenticator”, once this:

"http_authenticator":{"challenge":true,"type":"basic","config":{}},"authentication_backend":{"type":"intern","config":{}},"description":"Authenticate via HTTP Basic against internal users database"}

If helpful I can post here the complete output.

The config.yml in the opensearch config location has this

  basic_internal_auth_domain:
    description: "Authenticate via HTTP Basic against internal users database"
    http_enabled: false
    transport_enabled: false
    order: 4
    http_authenticator:
      type: "basic"
      challenge: true
    authentication_backend:
      type: "intern"

Thanks in advance,

Dietmar Schurr

6

Thanks! These, in the config file, suggest that basic auth is disabled, which is fine. What about the same config in the opensearch rest response? Are they enabled or disabled?

7

Hello Tomas,

I managed to fix it with iptables:

# Allow the trusted IP address to access port 9200
iptables -A INPUT -p tcp -s IP_node1 --dport 9200 -j ACCEPT
iptables -A INPUT -p tcp -s IP_node2 --dport 9200 -j ACCEPT
iptables -A INPUT -p tcp -s IP_node3 --dport 9200 -j ACCEPT
iptables -A INPUT -p tcp -s IP_graylog1 --dport 9200 -j ACCEPT
iptables -A INPUT -p tcp -s IP_graylog2 --dport 9200 -j ACCEPT

# Block everyone else from accessing port 9200

iptables -A INPUT -p tcp --dport 9200 -j DROP

Thanks for your help.

Regards,

Dietmar Schurr