Graylog2 / Graylog2/graylog2-server

Problem in indexes permissions

Open
#22,403 3 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

Good morning, afternoon and night. :)

I was configuring roles for the manteinance of my logcenter with graylog, and this problem came across the door. I can`t make a rol with only read permissions that let the user delete indexes.
This is because if i gave the role read permissions, it let me delete de indexes.

Investigate if this is fault of graylog, or by the way fault of elasticsearch.
Yeah, i forgot to mention, i use elasticsearch. I know that the support its deprecated, but today i had better performance with elastic.

The possible solution, i think you have to check how graylog manages the indexes and the roles of this management.

I put to the role the following permissions:
`{
"name": "Sistemas",
"description": "Rol de mantenimiento de solo lectura.",
"permissions": [
"clusterconfigentry:read",
"indexercluster:read",
"dashboards:read",
"eventdefinitions:read",
"streams:read",
"messagecount:read",
"journal:read",
"messages:analyze",
"metrics:read",
"indexsets:read",
"indices:read",
"fieldnames:read",
"buffers:read",
"indexranges:read",
"system:read",
"notifications:read",
"jvmstats:read",
"decorators:read",
"throughput:read",
"messages:read",
"eventnotifications:read"
],
"read_only": false
}`

It's possible that i made a mistake, but i can`t know if no one answer to me, like in the forum. Because of that i decide to open this issue, by the way it this is a real bug can be a problem so i have to tell you.

My envioranment:

* Graylog Version: graylog 6.0.12
* Elasticsearch Version: 7.0.6
* Operating System: Ubuntu server jammy
* Browser version: firefox in the last version actually.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.