[Meta] Security Plugin Bootstrapping Improvements

[peternied]

Background

When installing the security plugin, there are features that need to be turned on in concert to work together. Many options require thoughtful values that need to be carefully copied while others are carefully modified. Hardcoded demo certifications have been used and while that resolves the coping configurations it creates an illusion of security. There should be an established security baseline.

Problem

How should an OpenSearch instance with security startup in a way that is secure when:

• There might be multiple nodes
• There might be no access to external networks
• There is limited time to configure the system

Related issues

Round up additional issues

• Installing the security plugin without configuring it causes TLS errors #1631

[peternied]

[Proposal] Automatically sign / share certs with a trust on first use mode

After start-up, autogenerate self-signed certificates are used for communication. Once the ClusterManager is selected, a certification changeout process occurs where the ClusterManager creates its own CA cert, it rotates its existing self-signed cert with a fresh cert signed from the CA cert. Then the nodes begin rotation process where they provide the with a new cert that the ClusterManager signs, and they replace their cert.

This would require new APIs for certificate handoff related activities, but would also work in standard certification rotations. There also needs to be a way to make sure not just any node can insert itself into the signing related processes.

[peternied]

[Proposal] Support certification authority such as ACM Private CA or Lets Encrypt

In the configuration, add a way to identify the certificate management system, then add smaller for interaction with the various certificate authorities. Limitation of this process is that it requires all the nodes to be able to communicate with the external service, impact potential adoption.

[peternied]

[Proposal] OpenSearch Clients handshake with OpenSearch for trusted communication channel

With an additional API that clients could attempts on first connect, establishes the trusted connection without resorting to system level CA cert installations.

[peternied]

@setiah What do you think about some of these proposals?

[peternied]

@setiah could you incorporate some of these ideas into the admin experience?

[setiah]

[Proposal] Automatically sign / share certs with a trust on first use mode

After start-up, autogenerate self-signed certificates are used for communication. Once the ClusterManager is selected, a certification changeout process occurs where the ClusterManager creates its own CA cert, it rotates its existing self-signed cert with a fresh cert signed from the CA cert. Then the nodes begin rotation process where they provide the with a new cert that the ClusterManager signs, and they replace their cert.

This would require new APIs for certificate handoff related activities, but would also work in standard certification rotations. There also needs to be a way to make sure not just any node can insert itself into the signing related processes.

I am not sure if I understood the proposal fully, but I am aligned with the overall idea of removing demo certs and replacing them with auto-generated self-signed certificates out of the box. There are technical challenges we might need to think through such as how does this work for multi-node cluster

Could you please elaborate more on the approach and define ClusterManager and what it does.

[peternied]

We proposed to use "ClusterManager" as the replacement to the node role "master", after hearing opinions from PR #564.

From opensearch-project/OpenSearch#472 (comment)

This cluster startup process came from Trust on First Use (TOFU) that is also compliable for clusters that are inside a secured network.

Note: closing this issue

I realize that I did not included any context when I I closed this issue; while this is desired to make improvements in this space we are not actively working on these improvements or proposals. We can certainly revive them in future efforts.