Graylog2 / Graylog2/graylog2-server
Problem in indexes permissions
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
Good morning, afternoon and night. :)
I was configuring roles for the manteinance of my logcenter with graylog, and this problem came across the door. I can`t make a rol with only read permissions that let the user delete indexes.
This is because if i gave the role read permissions, it let me delete de indexes.
Investigate if this is fault of graylog, or by the way fault of elasticsearch.
Yeah, i forgot to mention, i use elasticsearch. I know that the support its deprecated, but today i had better performance with elastic.
The possible solution, i think you have to check how graylog manages the indexes and the roles of this management.
I put to the role the following permissions:
`{
"name": "Sistemas",
"description": "Rol de mantenimiento de solo lectura.",
"permissions": [
"clusterconfigentry:read",
"indexercluster:read",
"dashboards:read",
"eventdefinitions:read",
"streams:read",
"messagecount:read",
"journal:read",
"messages:analyze",
"metrics:read",
"indexsets:read",
"indices:read",
"fieldnames:read",
"buffers:read",
"indexranges:read",
"system:read",
"notifications:read",
"jvmstats:read",
"decorators:read",
"throughput:read",
"messages:read",
"eventnotifications:read"
],
"read_only": false
}`
It's possible that i made a mistake, but i can`t know if no one answer to me, like in the forum. Because of that i decide to open this issue, by the way it this is a real bug can be a problem so i have to tell you.
My envioranment:
* Graylog Version: graylog 6.0.12
* Elasticsearch Version: 7.0.6
* Operating System: Ubuntu server jammy
* Browser version: firefox in the last version actually.
Contributor guide
Assessment
This issue has not been assessed yet.