Graylog2 / Graylog2/graylog2-server
Sidecar - Support Beats keystore for storing private key passphrases
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
Add support in Sidecar for using keystores to store sensitive private key passphrases for Beats-based collectors.
## What?
All Beats collectors have a keystore mechanism that allows you to store the private key passphrases instead of having to specify them in cleartext in your Beats config. (ref: https://www.elastic.co/guide/en/beats/winlogbeat/8.9/keystore.html)
Then in your Beat config you pass a variable that references this value:
```
output.logstash.ssl.key_passphrase: "${MY_PASS}"
```
But Sidecar prevents this because the linter in the Collector configuration editor throws and error at the above variable reference, presumably because it thinks you're trying to reference a Sidecar variable that does not exist:
```
Template error: - Failed at: ${SSL_KEY_PASS} [in template "aa143208-4fb2-4e08-bcc1-f3dd2fac9c27" at line 13, column 24]
```
Using a Sidecar variable does not resolve this issue because it simply prints the variable value into the Beats config in plaintext, which is what we're trying to avoid.
## Why?
Enabling support for specifying a Beats variable in the Sidecar Collector configuration linter will allow users to use this secure keystore, enabling them not to expose their sensitive private key passphrases on all their endpoints.
If we support TLS-secured log collection via Sidecar + Beats, we should make all efforts to support secure configuration of this collection as well.
**Note:** This is a customer-driven request.
## Your Environment
* Graylog Version: 6.3
* Sidecar: 1.5.1
Contributor guide
Assessment
This issue has not been assessed yet.