Shutdown Kibana on usages of PKCS12 truststore/keystore config #192627

kc13greiner · 2024-09-11T18:28:28Z

Summary

Closes #169741

PKCS12 truststores/keystores are not FIPS compliant and should not be used when running if FIPS mode.

Users will be notified when they try to start KB in FIPS mode and are using the flagged settings and KB will exit.

Testing

You will need to generate a PKCS12 container (*.p12) file and have it stored somewhere that your local KB can access.

To generate a PKCS12 to use:

openssl req -x509 -newkey rsa:4096 -keyout myPrivateKey.pem -out myCertificate.crt
openssl pkcs12 -export -out keyStore.p12 -inkey myPrivateKey.pem -in myCertificate.crt
- Set password to test

Put the .p12 file in your config directory (not required, but you can copy and paste these commands easier)

Start an ES instance in a method of your choosing, but not using yarn es snapshot. I like to use an 8.16.0-snapshot from the .es/cache directory by running tar -xzvf elasticsearch-8.16.0-SNAPSHOT-darwin-aarch64.tar.gz and cd into the new directory's bin folder to run ./elasticsearch

In a new terminal window, navigate to your the top level of your elasticsearch folder and run:
curl -X POST --cacert config/certs/http_ca.crt -u elastic:YOUR_PASSWORD_HERE "https://localhost:9200/_license/start_trial?acknowledge=true&pretty"

This will enable the trial license for ES.

Ensure you have Docker running locally.

From any command line, run:

docker run --rm -it \
-v "$(pwd)"/config/keyStore.p12:/keyStore.p12:ro \
-e XPACK_SECURITY_FIPSMODE_ENABLED='true' \
-e ELASTICSEARCH_SSL_TRUSTSTORE_PATH='/keyStore.p12' \
-e ELASTICSEARCH_SSL_TRUSTSTORE_PASSWORD='test' \
-e ELASTICSEARCH_SSL_KEYSTORE_PATH='/keyStore.p12' \
-e ELASTICSEARCH_SSL_KEYSTORE_PASSWORD='test' \
-e SERVER_SSL_TRUSTSTORE_PATH='/keyStore.p12' \
-e SERVER_SSL_TRUSTSTORE_PASSWORD='test' \
-e SERVER_SSL_KEYSTORE_PATH='/keyStore.p12' \
-e SERVER_SSL_KEYSTORE_PASSWORD='test' \
-p 5601:5601/tcp docker.elastic.co/kibana-ci/kibana-ubi-fips:9.0.0-SNAPSHOT-92aeabf477867dc1768f9048b159f01f2ab1fcc3

This will start Kibana into Interactive Setup mode, copy and paste the token from the ES startup logs.

In your logs, you will see an error letting users know that PKCS12 settings are not allowed in FIPS

It should look like:

Release note

When running in FIPS mode, Kibana will forbid usage of PKCS12 configuration options

elasticmachine · 2024-09-11T21:41:55Z

Pinging @elastic/kibana-security (Team:Security)

jeramysoucy

LGTM! Thank you for the detailed testing instructions!

jloleysens

Great work! Left a couple of nits!

jloleysens · 2024-09-16T08:25:42Z

packages/core/security/core-security-server-internal/src/fips/fips.test.ts

      const logger = loggingSystemMock.create().get();

      try {
-        checkFipsConfig(config, logger);
+        checkFipsConfig(securityConfig, {}, {}, logger);


nit: what do you think about adding this on the next line?

fail('FIPS config check did not throw')

(ditto for other try catches like this)

++ added in latest commit

jloleysens · 2024-09-16T08:39:38Z

packages/core/security/core-security-server-internal/src/fips/fips.ts

    if (isFipsConfigEnabled !== isNodeRunningWithFipsEnabled) {
      logger.error(
        `Configuration mismatch error. xpack.security.experimental.fipsMode.enabled is set to ${isFipsConfigEnabled} and the configured Node.js environment has FIPS ${
          isNodeRunningWithFipsEnabled ? 'enabled' : 'disabled'
        }`
      );
+
+      process.exit(78);


Nit: I know process.exit is pre-existing, but I thought we could leverage the "shutdown" listener by throwing a CriticalError like this that allows providing a message and an exit code.

Happy to stick with the current approach, my primary thought was just to give Core the chance to run the shutdown lifecycle and might make testing a little bit easier 🤷🏻

I like the CriticalError approach, thanks for showing us this, @jloleysens!

++ added in latest commit - thank you for the guidance!!! It is way cleaner 🚀

kc13greiner · 2024-09-26T16:14:55Z

/ci

kibana-ci · 2024-09-26T16:59:57Z

💚 Build Succeeded

Buildkite Build
Commit: 92aeabf
Kibana UBI FIPS Image: docker.elastic.co/kibana-ci/kibana-ubi-fips:9.0.0-SNAPSHOT-92aeabf477867dc1768f9048b159f01f2ab1fcc3

Metrics [docs]

✅ unchanged

History

💚 Build #237444 succeeded 92aeabf
💛 Build #237346 was flaky dbbbb34
💛 Build #234291 was flaky aeb94dd
💛 Build #233589 was flaky 1246d98

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @kc13greiner

jeramysoucy · 2024-09-27T13:21:01Z

Retested with latest changes. LGTM!

kibanamachine · 2024-11-19T20:46:11Z

Starting backport for target branches: 8.16, 8.x

https://github.com/elastic/kibana/actions/runs/11921474910

kibanamachine · 2024-11-19T20:46:12Z

Starting backport for target branches: 8.16, 8.x

https://github.com/elastic/kibana/actions/runs/11921474967

…ic#192627) ## Summary Closes elastic#169741 PKCS12 truststores/keystores are not FIPS compliant and should not be used when running if FIPS mode. Users will be notified when they try to start KB in FIPS mode and are using the flagged settings and KB will exit. ## Testing You will need to generate a PKCS12 container (*.p12) file and have it stored somewhere that your local KB can access. To generate a PKCS12 to use: - `openssl req -x509 -newkey rsa:4096 -keyout myPrivateKey.pem -out myCertificate.crt` - `openssl pkcs12 -export -out keyStore.p12 -inkey myPrivateKey.pem -in myCertificate.crt` - Set password to `test` Put the `.p12` file in your `config` directory (not required, but you can copy and paste these commands easier) Start an ES instance in a method of your choosing, but not using yarn es snapshot. I like to use an 8.16.0-snapshot from the .es/cache directory by running tar -xzvf elasticsearch-8.16.0-SNAPSHOT-darwin-aarch64.tar.gz and cd into the new directory's bin folder to run ./elasticsearch In a new terminal window, navigate to your the top level of your elasticsearch folder and run: `curl -X POST --cacert config/certs/http_ca.crt -u elastic:YOUR_PASSWORD_HERE "https://localhost:9200/_license/start_trial?acknowledge=true&pretty"` This will enable the trial license for ES. Ensure you have Docker running locally. From any command line, run: ``` docker run --rm -it \ -v "$(pwd)"/config/keyStore.p12:/keyStore.p12:ro \ -e XPACK_SECURITY_FIPSMODE_ENABLED='true' \ -e ELASTICSEARCH_SSL_TRUSTSTORE_PATH='/keyStore.p12' \ -e ELASTICSEARCH_SSL_TRUSTSTORE_PASSWORD='test' \ -e ELASTICSEARCH_SSL_KEYSTORE_PATH='/keyStore.p12' \ -e ELASTICSEARCH_SSL_KEYSTORE_PASSWORD='test' \ -e SERVER_SSL_TRUSTSTORE_PATH='/keyStore.p12' \ -e SERVER_SSL_TRUSTSTORE_PASSWORD='test' \ -e SERVER_SSL_KEYSTORE_PATH='/keyStore.p12' \ -e SERVER_SSL_KEYSTORE_PASSWORD='test' \ -p 5601:5601/tcp docker.elastic.co/kibana-ci/kibana-ubi-fips:9.0.0-SNAPSHOT-92aeabf477867dc1768f9048b159f01f2ab1fcc3 ``` This will start Kibana into Interactive Setup mode, copy and paste the token from the ES startup logs. In your logs, you will see an error letting users know that PKCS12 settings are not allowed in FIPS It should look like: <img width="1767" alt="Screenshot 2024-09-11 at 1 57 22 PM" src="https://github.com/user-attachments/assets/c32c03b6-98b9-476d-8624-8cc1a535e23f"> ## Release note When running in FIPS mode, Kibana will forbid usage of PKCS12 configuration options --------- Co-authored-by: Jean-Louis Leysens <[email protected]> (cherry picked from commit a002a1b)

kibanamachine · 2024-11-19T20:51:09Z

💚 All backports created successfully

Status	Branch	Result
✅	8.16
✅	8.x

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

…ic#192627) ## Summary Closes elastic#169741 PKCS12 truststores/keystores are not FIPS compliant and should not be used when running if FIPS mode. Users will be notified when they try to start KB in FIPS mode and are using the flagged settings and KB will exit. ## Testing You will need to generate a PKCS12 container (*.p12) file and have it stored somewhere that your local KB can access. To generate a PKCS12 to use: - `openssl req -x509 -newkey rsa:4096 -keyout myPrivateKey.pem -out myCertificate.crt` - `openssl pkcs12 -export -out keyStore.p12 -inkey myPrivateKey.pem -in myCertificate.crt` - Set password to `test` Put the `.p12` file in your `config` directory (not required, but you can copy and paste these commands easier) Start an ES instance in a method of your choosing, but not using yarn es snapshot. I like to use an 8.16.0-snapshot from the .es/cache directory by running tar -xzvf elasticsearch-8.16.0-SNAPSHOT-darwin-aarch64.tar.gz and cd into the new directory's bin folder to run ./elasticsearch In a new terminal window, navigate to your the top level of your elasticsearch folder and run: `curl -X POST --cacert config/certs/http_ca.crt -u elastic:YOUR_PASSWORD_HERE "https://localhost:9200/_license/start_trial?acknowledge=true&pretty"` This will enable the trial license for ES. Ensure you have Docker running locally. From any command line, run: ``` docker run --rm -it \ -v "$(pwd)"/config/keyStore.p12:/keyStore.p12:ro \ -e XPACK_SECURITY_FIPSMODE_ENABLED='true' \ -e ELASTICSEARCH_SSL_TRUSTSTORE_PATH='/keyStore.p12' \ -e ELASTICSEARCH_SSL_TRUSTSTORE_PASSWORD='test' \ -e ELASTICSEARCH_SSL_KEYSTORE_PATH='/keyStore.p12' \ -e ELASTICSEARCH_SSL_KEYSTORE_PASSWORD='test' \ -e SERVER_SSL_TRUSTSTORE_PATH='/keyStore.p12' \ -e SERVER_SSL_TRUSTSTORE_PASSWORD='test' \ -e SERVER_SSL_KEYSTORE_PATH='/keyStore.p12' \ -e SERVER_SSL_KEYSTORE_PASSWORD='test' \ -p 5601:5601/tcp docker.elastic.co/kibana-ci/kibana-ubi-fips:9.0.0-SNAPSHOT-92aeabf477867dc1768f9048b159f01f2ab1fcc3 ``` This will start Kibana into Interactive Setup mode, copy and paste the token from the ES startup logs. In your logs, you will see an error letting users know that PKCS12 settings are not allowed in FIPS It should look like: <img width="1767" alt="Screenshot 2024-09-11 at 1 57 22 PM" src="https://github.com/user-attachments/assets/c32c03b6-98b9-476d-8624-8cc1a535e23f"> ## Release note When running in FIPS mode, Kibana will forbid usage of PKCS12 configuration options --------- Co-authored-by: Jean-Louis Leysens <[email protected]> (cherry picked from commit a002a1b)

kibanamachine · 2024-11-19T20:51:18Z

💚 All backports created successfully

Status	Branch	Result
✅	8.16
✅	8.x

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

…192627) (#200818) # Backport This will backport the following commits from `main` to `8.x`: - [Shutdown Kibana on usages of PKCS12 truststore/keystore config (#192627)](#192627)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport)  Co-authored-by: Kurt <[email protected]>

adding check for pkcs12 to fips in security service

04e960f

kc13greiner added Team:Security Team focused on: Auth, Users, Roles, Spaces, Audit Logging, and more! backport:skip This commit does not require backporting release_note:feature Makes this part of the condensed release notes v8.16.0 labels Sep 11, 2024

Merge branch 'main' into feature/pkcs12_checks_fips

1246d98

kc13greiner added the ci:build-docker-fips Build Docker FIPS image label Sep 11, 2024

kc13greiner self-assigned this Sep 11, 2024

kc13greiner marked this pull request as ready for review September 11, 2024 21:41

kc13greiner requested a review from a team as a code owner September 11, 2024 21:41

kc13greiner requested a review from a team September 11, 2024 21:42

jeramysoucy approved these changes Sep 13, 2024

View reviewed changes

jloleysens approved these changes Sep 16, 2024

View reviewed changes

jloleysens and others added 3 commits September 16, 2024 10:45

Merge branch 'main' into feature/pkcs12_checks_fips

aeb94dd

Merge branch 'main' into feature/pkcs12_checks_fips

dbbbb34

Switching to use Core CriticalError interceptor

92aeabf

kc13greiner merged commit a002a1b into elastic:main Sep 27, 2024
22 checks passed

kc13greiner removed the ci:build-docker-fips Build Docker FIPS image label Sep 27, 2024

kibanamachine added the v9.0.0 label Sep 27, 2024

kibanamachine mentioned this pull request Oct 25, 2024

[FTR] Merge Alerting Apis from x-pack/test_serverless/shared into x-pack/test/api_integration/deployment_agnostic #193975

Merged

kibanamachine mentioned this pull request Nov 19, 2024

Removing experimental for the FIPS mode config #200734

Merged

kc13greiner added backport:version Backport to applied version labels v8.17.0 and removed backport:skip This commit does not require backporting labels Nov 19, 2024

kc13greiner removed the v8.16.0 label Nov 19, 2024

kibanamachine mentioned this pull request Nov 19, 2024

[8.16] Shutdown Kibana on usages of PKCS12 truststore/keystore config (#192627) #200816

Closed

kibanamachine mentioned this pull request Nov 19, 2024

[8.x] Shutdown Kibana on usages of PKCS12 truststore/keystore config (#192627) #200818

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Shutdown Kibana on usages of PKCS12 truststore/keystore config #192627

Shutdown Kibana on usages of PKCS12 truststore/keystore config #192627

kc13greiner commented Sep 11, 2024 •

edited by kibanamachine

Loading

elasticmachine commented Sep 11, 2024

jeramysoucy left a comment

jloleysens left a comment

jloleysens Sep 16, 2024

kc13greiner Sep 26, 2024

jloleysens Sep 16, 2024

legrego Sep 17, 2024

kc13greiner Sep 26, 2024

kc13greiner commented Sep 26, 2024

kibana-ci commented Sep 26, 2024 •

edited

Loading

jeramysoucy commented Sep 27, 2024

kibanamachine commented Nov 19, 2024

kibanamachine commented Nov 19, 2024

kibanamachine commented Nov 19, 2024

kibanamachine commented Nov 19, 2024

Shutdown Kibana on usages of PKCS12 truststore/keystore config #192627

Shutdown Kibana on usages of PKCS12 truststore/keystore config #192627

Conversation

kc13greiner commented Sep 11, 2024 • edited by kibanamachine Loading

Summary

Testing

Release note

elasticmachine commented Sep 11, 2024

jeramysoucy left a comment

Choose a reason for hiding this comment

jloleysens left a comment

Choose a reason for hiding this comment

jloleysens Sep 16, 2024

Choose a reason for hiding this comment

kc13greiner Sep 26, 2024

Choose a reason for hiding this comment

jloleysens Sep 16, 2024

Choose a reason for hiding this comment

legrego Sep 17, 2024

Choose a reason for hiding this comment

kc13greiner Sep 26, 2024

Choose a reason for hiding this comment

kc13greiner commented Sep 26, 2024

kibana-ci commented Sep 26, 2024 • edited Loading

💚 Build Succeeded

Metrics [docs]

History

jeramysoucy commented Sep 27, 2024

kibanamachine commented Nov 19, 2024

kibanamachine commented Nov 19, 2024

kibanamachine commented Nov 19, 2024

💚 All backports created successfully

Questions ?

kibanamachine commented Nov 19, 2024

💚 All backports created successfully

Questions ?

kc13greiner commented Sep 11, 2024 •

edited by kibanamachine

Loading

kibana-ci commented Sep 26, 2024 •

edited

Loading