Graylog2 / Graylog2/graylog2-server

Sidecar - Support Beats keystore for storing private key passphrases

Open
#23,313 1 comment 0 reactions 0 assignees View on GitHub
feature triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

Add support in Sidecar for using keystores to store sensitive private key passphrases for Beats-based collectors.

## What?
All Beats collectors have a keystore mechanism that allows you to store the private key passphrases instead of having to specify them in cleartext in your Beats config. (ref: https://www.elastic.co/guide/en/beats/winlogbeat/8.9/keystore.html)

Then in your Beat config you pass a variable that references this value:
```
output.logstash.ssl.key_passphrase: "${MY_PASS}"
```

But Sidecar prevents this because the linter in the Collector configuration editor throws and error at the above variable reference, presumably because it thinks you're trying to reference a Sidecar variable that does not exist:
```
Template error: - Failed at: ${SSL_KEY_PASS} [in template "aa143208-4fb2-4e08-bcc1-f3dd2fac9c27" at line 13, column 24]
```

Image

Using a Sidecar variable does not resolve this issue because it simply prints the variable value into the Beats config in plaintext, which is what we're trying to avoid.

## Why?
Enabling support for specifying a Beats variable in the Sidecar Collector configuration linter will allow users to use this secure keystore, enabling them not to expose their sensitive private key passphrases on all their endpoints.

If we support TLS-secured log collection via Sidecar + Beats, we should make all efforts to support secure configuration of this collection as well.

**Note:** This is a customer-driven request.

## Your Environment

* Graylog Version: 6.3
* Sidecar: 1.5.1

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.