转 Shield Your Kibana Dashboards

You work with sensitive data in Elasticsearch indices that you do not want everyone to see in their Kibana dashboards. Like a hospital with patient names. You could give each department their own Elasticsearch cluster in order to prevent all departments to see the patient's names, for example.

But wouldn't it be great if there was only one Elasticsearch cluster and every departments could manage their own Kibana dashboards? And still have the security in place to prevent leaking of private data?

With Elasticsearch Shield, you can create a configurable layer of security on top of your Elasticsearch cluster.In this article, we will explore a small example setup with Shield and Kibana.

In this article, we'll use Elasticsearch 1.4.4, Shield 1.0.1 and Kibana 4.0.0. These are at the time of writing the most-recent  versions. Beginner knowledge of Elasticsearch is expected.

Suppose we want to keep our patient’s names private. An index of patients will be available only for one department. An index of cases will be available to all departments.

First, we'll add some test data to the cluster. Create a file hospital.json with the following content:

Then bulk index these documents in the cluster:

Without security, every user can access all documents. Let's install Shield to add security.

Directions on how to install Shield can be found at the Elasticsearch website . We will do this step by step.

Shield is a commercial product, so first we need to install the license manager:

Now install Shield itself in the same manner:

You will need to restart the nodes of your cluster to activate the plugins.

In the logs of Elasticsearch you'll see some messages from the new plugins:

Notice that you will get a 30-day trial period to experiment with Shield. Now all our data is protected. See what happens when we try to get a document:

We need to add some roles and users to configure the role-based access control of Shield. First we define the roles and their privileges. The definition of these are found in the elasticsearch/config/shield/roles.yml file. Some roles, like admin and user are predefined:

Let's edit this roles.yml file to describe our needs. We do not want for every user to access all indices, so we'll change user.indices . We'll add the two roles needed for our organization: doctor and nurse. A doctor has more privileges than a nurse. Doctors can access all indices. Nurses can only access the cases index:

Now that the roles are defined, we can create users that have these roles. Shield provides three realms to store the users: an internal realm, LDAP or Active Directory. For now, we use the internal realm. The realm is configured in elasticsearch/config/elasticsearch.yml . If nothing is explicitly configured, the internal realm is used.

To add users the esusers command line tool can be used. Let's create two users (both with abc123 as password), one for each role:

Just to check if the security works:

Alice can see the 5 cases in our cases index. Bob can see those 5 cases plus the 5 patients in the patients index.

Now it's time to add Kibana in the mix. Instructions to download and install Kibana 4 can be found on the Elasticsearch website.

When we start the Kibana server we notice that Kibana is not allowed access to the Elasticsearch cluster:

We need to tell Shield that Kibana is allowed to access our cluster. Extra information of how to let Kibana work with Shield can be found in the Elasticsearch guide .

Shield is shipped with a default configuration for Kibana 4. We find the following role definition in elasticsearch/config/shield/roles.yml.

When the Kibana Server starts it needs to access the .kibana index. So we need to create a user in Shield for Kibana to connect with:

This account must be configured in Kibana. Modify kibana/conf/kibana.yml :

The Kibana users must have the kibana4 role to be able to work with Kibana. They must be able to store their visualizations and dashboards in the .kibana index:

Since the default kibana4 role has read access on all indices, alice and bob will be granted all access on all indices. Therefore the role permissions must be modified:

With this configuration any user with the kibana4 role is able to use Kibana but only sees data that he or she has the proper clearance for.

We can now start the Kibana Server and see that it runs as it should:

We can open a browser and head to localhost:5601 to open the Kibana web interface. Log in as Alice:

After logging in, Kibana will ask for the index pattern. We'll keep it simple:

Then in the discover tab you can add fields to your view. Notice that Alice only sees cases:

When we log in as Bob our discover tab shows both cases and patients:

To summarize: we added security to Elasticsearch with Shield and configured some users and roles. There's nothing more to it!

原文地址：http://blog.trifork.com/2015/03/05/shield-your-kibana-dashboards/