Security best practices - 10 points to consider - #5782 #7113

leanneeliatra · 2024-05-08T14:44:19Z

Description

We are adding a new page in the documentation, outlining the best practices/considerations for security in OpenSearch.
Covering the ten points below:

Use your own PKI (public key infrastructure) to setup SSL/TLS for OpenSearch
Prefer client certificate authentication for API authentication
Prefer SSO using SAML or OpenID for Dashboards authentication
Limit the number of roles assigned to a user
Verify DLS, FLS and field masking
Strip audit logging configuration to essentials only
Explore disabling private tenant
Manage the configuration via securityadmin.sh
Replace all default passwords
Stay informed and apply updates

Issues Resolved

Closes #5782

Checklist

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and subject to the Developers Certificate of Origin.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

leanneeliatra · 2024-05-08T14:46:19Z

@hdhalter can I bring your attention to the first draft of the security best practices document please. @AntonEliatra is adding more information tomorrow and many of the topics will be expanded on.

Please add the security tag to this ticket too so it shows up on the list of PRs, thanks a million.

Signed-off-by: [email protected] <[email protected]>

Signed-off-by: AntonEliatra <[email protected]>

…ra/opensearch-documentation-website-forl into best-practice3

Signed-off-by: AntonEliatra <[email protected]>

leanneeliatra · 2024-05-14T15:23:15Z

@hdhalter cc @scrawfor99 Ready for review. Thanks a million.

natebower

@leanneeliatra @Naarcha-AWS Please see my comments and changes and tag me for approval when complete. Thanks!

_security/configuration/best-practices.md

Co-authored-by: Nathan Bower <[email protected]> Signed-off-by: leanneeliatra <[email protected]>

Signed-off-by: AntonEliatra <[email protected]>

AntonEliatra · 2024-05-22T13:42:17Z

@natebower thats been updated now

natebower

@Naarcha-AWS @AntonEliatra @leanneeliatra Some outstanding comments. Thanks!

natebower · 2024-05-22T13:58:28Z

_security/configuration/best-practices.md

+### Replace all demo certificates with your own PKI
+The certificates generated when initializing an OpenSearch cluster with `install_demo_configuration.sh` are not suitable for production. These should be replaced with your own certificates.
+
+You can generate custom certificates in a few different ways. One approach is to use OpenSSL, described in detail at [Generating self-signed certificates]({{site.url}}{{site.baseurl}}/security/configuration/generate-certificates/). Alternatively, there are online tools available that can simplify the certificate creation process.


I'm not sure that @Naarcha-AWS and I's comments here have been addressed.

_security/configuration/best-practices.md

natebower · 2024-05-22T14:16:08Z

_security/configuration/best-practices.md

+
+## 10. Stay informed and apply updates
+
+Regularly monitor OpenSearch Project security advisories and updates to stay informed about potential vulnerabilities or bugs. Promptly apply updates to the Security plugin and its dependencies to maintain a secure environment.


It looks like my comment re: a link has not been addressed.

Signed-off-by: AntonEliatra <[email protected]>

Signed-off-by: Naarcha-AWS <[email protected]>

Signed-off-by: AntonEliatra <[email protected]>

_security/configuration/best-practices.md

Co-authored-by: Nathan Bower <[email protected]> Signed-off-by: AntonEliatra <[email protected]>

Signed-off-by: AntonEliatra <[email protected]>

natebower

Thanks @leanneeliatra @AntonEliatra @Naarcha-AWS! LGTM once the remaining comment is resolved.

_security/configuration/best-practices.md

leanneeliatra · 2024-05-28T19:58:34Z

@leanneeliatra @Naarcha-AWS Please see my comments and changes and tag me for approval when complete. Thanks!

Hi @natebower thanks a million.
Your changes are all integrated now and ready for review.

Signed-off-by: Naarcha-AWS <[email protected]>

_security/configuration/best-practices.md

Signed-off-by: Naarcha-AWS <[email protected]>

natebower

@Naarcha-AWS LGTM with the noted changes. Thanks!

_security/configuration/best-practices.md

Co-authored-by: Nathan Bower <[email protected]> Signed-off-by: Naarcha-AWS <[email protected]>

* adding top ten security best practices Signed-off-by: [email protected] <[email protected]> * changing nav order Signed-off-by: [email protected] <[email protected]> * adding to best practices Signed-off-by: AntonEliatra <[email protected]> * adding to best practices Signed-off-by: AntonEliatra <[email protected]> * adding to best practices Signed-off-by: AntonEliatra <[email protected]> * adding bonus tip Signed-off-by: [email protected] <[email protected]> * updates to best practices Signed-off-by: [email protected] <[email protected]> * integrating Darshits suggestions for improvement and reviewdog fixes Signed-off-by: [email protected] <[email protected]> * review suggestions to grammer Signed-off-by: [email protected] <[email protected]> * review suggestions to grammer Signed-off-by: [email protected] <[email protected]> * review suggestions to grammer Signed-off-by: [email protected] <[email protected]> * review suggestions to grammer Signed-off-by: [email protected] <[email protected]> * review suggestions to grammer Signed-off-by: [email protected] <[email protected]> * reviewdog update Signed-off-by: [email protected] <[email protected]> * Apply suggestions from code review Co-authored-by: Naarcha-AWS <[email protected]> Signed-off-by: leanneeliatra <[email protected]> * reviewdog updates Signed-off-by: [email protected] <[email protected]> * Update _security/configuration/best-practices.md Signed-off-by: Naarcha-AWS <[email protected]> * Apply suggestions from code review Co-authored-by: Nathan Bower <[email protected]> Signed-off-by: leanneeliatra <[email protected]> * Update best-practices.md Signed-off-by: AntonEliatra <[email protected]> * Update best-practices.md Signed-off-by: AntonEliatra <[email protected]> * Add editorial comment Signed-off-by: Naarcha-AWS <[email protected]> * Update best-practices.md Signed-off-by: AntonEliatra <[email protected]> * Update _security/configuration/best-practices.md Co-authored-by: Nathan Bower <[email protected]> Signed-off-by: AntonEliatra <[email protected]> * Update best-practices.md Signed-off-by: AntonEliatra <[email protected]> * Update best-practices.md Signed-off-by: Naarcha-AWS <[email protected]> * Apply suggestions from code review Signed-off-by: Naarcha-AWS <[email protected]> * Apply suggestions from code review Co-authored-by: Nathan Bower <[email protected]> Signed-off-by: Naarcha-AWS <[email protected]> --------- Signed-off-by: [email protected] <[email protected]> Signed-off-by: AntonEliatra <[email protected]> Signed-off-by: leanneeliatra <[email protected]> Signed-off-by: Naarcha-AWS <[email protected]> Co-authored-by: AntonEliatra <[email protected]> Co-authored-by: Naarcha-AWS <[email protected]> Co-authored-by: Nathan Bower <[email protected]> (cherry picked from commit 8e049cd) Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

…5782 (opensearch-project#7113) * adding top ten security best practices Signed-off-by: [email protected] <[email protected]> * changing nav order Signed-off-by: [email protected] <[email protected]> * adding to best practices Signed-off-by: AntonEliatra <[email protected]> * adding to best practices Signed-off-by: AntonEliatra <[email protected]> * adding to best practices Signed-off-by: AntonEliatra <[email protected]> * adding bonus tip Signed-off-by: [email protected] <[email protected]> * updates to best practices Signed-off-by: [email protected] <[email protected]> * integrating Darshits suggestions for improvement and reviewdog fixes Signed-off-by: [email protected] <[email protected]> * review suggestions to grammer Signed-off-by: [email protected] <[email protected]> * review suggestions to grammer Signed-off-by: [email protected] <[email protected]> * review suggestions to grammer Signed-off-by: [email protected] <[email protected]> * review suggestions to grammer Signed-off-by: [email protected] <[email protected]> * review suggestions to grammer Signed-off-by: [email protected] <[email protected]> * reviewdog update Signed-off-by: [email protected] <[email protected]> * Apply suggestions from code review Co-authored-by: Naarcha-AWS <[email protected]> Signed-off-by: leanneeliatra <[email protected]> * reviewdog updates Signed-off-by: [email protected] <[email protected]> * Update _security/configuration/best-practices.md Signed-off-by: Naarcha-AWS <[email protected]> * Apply suggestions from code review Co-authored-by: Nathan Bower <[email protected]> Signed-off-by: leanneeliatra <[email protected]> * Update best-practices.md Signed-off-by: AntonEliatra <[email protected]> * Update best-practices.md Signed-off-by: AntonEliatra <[email protected]> * Add editorial comment Signed-off-by: Naarcha-AWS <[email protected]> * Update best-practices.md Signed-off-by: AntonEliatra <[email protected]> * Update _security/configuration/best-practices.md Co-authored-by: Nathan Bower <[email protected]> Signed-off-by: AntonEliatra <[email protected]> * Update best-practices.md Signed-off-by: AntonEliatra <[email protected]> * Update best-practices.md Signed-off-by: Naarcha-AWS <[email protected]> * Apply suggestions from code review Signed-off-by: Naarcha-AWS <[email protected]> * Apply suggestions from code review Co-authored-by: Nathan Bower <[email protected]> Signed-off-by: Naarcha-AWS <[email protected]> --------- Signed-off-by: [email protected] <[email protected]> Signed-off-by: AntonEliatra <[email protected]> Signed-off-by: leanneeliatra <[email protected]> Signed-off-by: Naarcha-AWS <[email protected]> Co-authored-by: AntonEliatra <[email protected]> Co-authored-by: Naarcha-AWS <[email protected]> Co-authored-by: Nathan Bower <[email protected]>

leanneeliatra requested review from hdhalter, kolchfa-aws, Naarcha-AWS, vagimeli, AMoo-Miki, natebower, dlvenable, stephen-crawford and epugh as code owners May 8, 2024 14:44

leanneeliatra changed the title ~~Security best practices 5782~~ [DRAFT] Security best practices 5782 May 8, 2024

leanneeliatra added 2 commits May 8, 2024 15:46

adding top ten security best practices

7486476

Signed-off-by: [email protected] <[email protected]>

changing nav order

d831f8a

Signed-off-by: [email protected] <[email protected]>

leanneeliatra force-pushed the Security-best-practices-5782 branch from c1363db to d831f8a Compare May 8, 2024 14:46

hdhalter added 2 - In progress Issue/PR: The issue or PR is in progress. security backport 2.13 PR: Backport label for 2.13 labels May 8, 2024

leanneeliatra and others added 5 commits May 9, 2024 15:06

Merge branch 'opensearch-project:main' into Security-best-practices-5782

b3b0b9b

adding to best practices

970aa7f

Signed-off-by: AntonEliatra <[email protected]>

Merge branch 'Security-best-practices-5782' of github.com:leanneeliat…

9961ef6

…ra/opensearch-documentation-website-forl into best-practice3

adding to best practices

e22396f

Signed-off-by: AntonEliatra <[email protected]>

adding to best practices

d12aa8a

Signed-off-by: AntonEliatra <[email protected]>

hdhalter assigned leanneeliatra May 10, 2024

leanneeliatra added 2 commits May 13, 2024 09:59

Merge branch 'main' into Security-best-practices-5782

5e7c343

Merge branch 'main' into Security-best-practices-5782

7a08ebc

leanneeliatra changed the title ~~[DRAFT] Security best practices 5782~~ Security best practices - 10 points to consider - #5782 May 14, 2024

leanneeliatra mentioned this pull request May 14, 2024

[DOC] Add a new section in documentation for security best practices and recommendations. #5782

Closed

hdhalter added 3 - Tech review PR: Tech review in progress and removed 2 - In progress Issue/PR: The issue or PR is in progress. labels May 14, 2024

Naarcha-AWS added 5 - Editorial review PR: Editorial review in progress and removed 4 - Doc review PR: Doc review in progress labels May 21, 2024

natebower requested changes May 22, 2024

View reviewed changes

leanneeliatra and others added 2 commits May 22, 2024 13:26

Apply suggestions from code review

ded7296

Co-authored-by: Nathan Bower <[email protected]> Signed-off-by: leanneeliatra <[email protected]>

Update best-practices.md

f9ef39d

Signed-off-by: AntonEliatra <[email protected]>

natebower reviewed May 22, 2024

View reviewed changes

AntonEliatra and others added 3 commits May 22, 2024 16:45

Update best-practices.md

f4cfe49

Signed-off-by: AntonEliatra <[email protected]>

Add editorial comment

929bbe5

Signed-off-by: Naarcha-AWS <[email protected]>

Update best-practices.md

6ad7e05

Signed-off-by: AntonEliatra <[email protected]>

natebower reviewed May 22, 2024

View reviewed changes

_security/configuration/best-practices.md Outdated Show resolved Hide resolved

AntonEliatra and others added 2 commits May 24, 2024 08:21

Update _security/configuration/best-practices.md

c63625f

Co-authored-by: Nathan Bower <[email protected]> Signed-off-by: AntonEliatra <[email protected]>

Update best-practices.md

85c33e4

Signed-off-by: AntonEliatra <[email protected]>

natebower approved these changes May 24, 2024

View reviewed changes

_security/configuration/best-practices.md Outdated Show resolved Hide resolved

leanneeliatra and others added 2 commits May 28, 2024 20:58

Merge branch 'main' into Security-best-practices-5782

8b751ec

Update best-practices.md

1a5388d

Signed-off-by: Naarcha-AWS <[email protected]>

Naarcha-AWS reviewed May 29, 2024

View reviewed changes

_security/configuration/best-practices.md Outdated Show resolved Hide resolved

Naarcha-AWS reviewed May 29, 2024

View reviewed changes

_security/configuration/best-practices.md Outdated Show resolved Hide resolved

Naarcha-AWS reviewed May 29, 2024

View reviewed changes

_security/configuration/best-practices.md Outdated Show resolved Hide resolved

Apply suggestions from code review

312313f

Signed-off-by: Naarcha-AWS <[email protected]>

natebower approved these changes May 30, 2024

View reviewed changes

Apply suggestions from code review

a2b00a3

Co-authored-by: Nathan Bower <[email protected]> Signed-off-by: Naarcha-AWS <[email protected]>

Naarcha-AWS merged commit 8e049cd into opensearch-project:main May 30, 2024
5 checks passed

opensearch-trigger-bot bot mentioned this pull request May 30, 2024

[Backport 2.14] Security best practices - 10 points to consider - #5782 #7274

Merged

github-actions bot pushed a commit that referenced this pull request May 30, 2024

Security best practices - 10 points to consider - #5782 (#7113) (#7274)

83a637b

hdhalter added 3 - Done Issue is done/complete and removed 5 - Editorial review PR: Editorial review in progress labels Jul 24, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Security best practices - 10 points to consider - #5782 #7113

Security best practices - 10 points to consider - #5782 #7113

leanneeliatra commented May 8, 2024 •

edited

Loading

leanneeliatra commented May 8, 2024

leanneeliatra commented May 14, 2024

natebower left a comment

AntonEliatra commented May 22, 2024

natebower left a comment

natebower May 22, 2024

natebower May 22, 2024

natebower left a comment

leanneeliatra commented May 28, 2024 •

edited

Loading

natebower left a comment


		## 10. Stay informed and apply updates

		Regularly monitor OpenSearch Project security advisories and updates to stay informed about potential vulnerabilities or bugs. Promptly apply updates to the Security plugin and its dependencies to maintain a secure environment.

Security best practices - 10 points to consider - #5782 #7113

Security best practices - 10 points to consider - #5782 #7113

Conversation

leanneeliatra commented May 8, 2024 • edited Loading

Description

Issues Resolved

Checklist

leanneeliatra commented May 8, 2024

leanneeliatra commented May 14, 2024

natebower left a comment

Choose a reason for hiding this comment

AntonEliatra commented May 22, 2024

natebower left a comment

Choose a reason for hiding this comment

natebower May 22, 2024

Choose a reason for hiding this comment

natebower May 22, 2024

Choose a reason for hiding this comment

natebower left a comment

Choose a reason for hiding this comment

leanneeliatra commented May 28, 2024 • edited Loading

natebower left a comment

Choose a reason for hiding this comment

leanneeliatra commented May 8, 2024 •

edited

Loading

leanneeliatra commented May 28, 2024 •

edited

Loading