Xpack security troubles

[Mo_the_literate (Mo)]

Hi guys,

I have installed graylog-server 4.3.5-1 on Debian 11.4 as well as elasticsearch 7.17.5

When I run the setup without uncommenting
#xpack.security.enabled: true
I get these here warnings in logs:
Elasticsearch built-in security features are not enabled. Without authentication, your cluster could be accessible to anyone. See (link obfuscated) /guide/en/elasticsearch/reference/7.17/security-minimal-setup.html to enable security."]

So I decided to try to enable xpack security and did the following to try to achieve that:

I uncommented “#xpack.security.enabled: true” in /etc/elasticsearch/elasticsearch.yml

I ran “./bin/elasticsearch-setup-passwords auto” to set passwords for built-in users.

I created the follwing role:

{
“graylog_role” : {
“cluster” : [
“monitor”,
“manage”,
“all”
],
“indices” : [
{
“names” : [
“*”
],
“privileges” : [
“all”
],
“allow_restricted_indices” : false
}
],
“applications” : ,
“run_as” : ,
“metadata” : { },
“transient_metadata” : {
“enabled” : true
}
}
}

and lastly I created the follwing user:

{
“myelasticuser” : {
“username” : “myelasticuser”,
“roles” : [
“graylog_role”
],
“full_name” : “elastic graylog user”,
“email” : “emailaddress@example.com”,
“metadata” : {
“intelligence” : 1
},
“enabled” : true
}
}

Now I get the follwing in logs:

ERROR [VersionProbe] Unable to retrieve version from Elasticsearch node 127.0.0.1:9200: Error response: type: security_exception - reason: action [cluster:monitor/main] is unauthorized for user [myelasticuser] with roles [all,monitor,manage], this action is granted by the cluster privileges [monitor,manage,all]

and nothing works.

Am I missing a step?

[tmacgbay]

First issue noted right away, Graylog only supports to Elasticsearch 7.10.2. so your 7.17.5 installation may cause all sorts of issues, including possibly the one you are having with configuration. Further, Graylog is moving away from Elasticsearch entirely due to licensing and configuration issues (with anything beyond 7.10.2) and is moving to OpenSearch 1.x (Graylog is not currently compatible with OpenSearch 2.x)

So if at all possible I would start by moving to OpenSearch 1.3 (current in compatibility) and then work on security for your installation from there (I haven’t researched if xpack is the right choice or even possible with Opensearch yet… but I will)

[gsmith]

Hello,
Adding on to @tmacgbay

In the past when using OpenDistro for Elasticsearch ( i.e., version 7.10) I was able to use the security feature , But with Elastic’s Elasticsearch I was unable to, perhaps it was the settings or license issue.

[Mo_the_literate (Mo)]

Thank you very much for your extremely useful and knowledgeable reply. We will reconsider our options.