Graylog2 / Graylog2/graylog2-server
Allow customization of footer
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
### The present implementation

### The good
- Administrators often glance on that information (I know I do), it's useful for them
### The bad
Issue 1:
- Most formal security policies require a legal disclaimer to be shown at login ([example from STIGs](https://www.stigviewer.com/stig/red_hat_enterprise_linux_6/2015-05-26/finding/V-38689)), and preferably all the time. This is often solved by adding a footer - a solution that fulfills the requirement without bugging the users too much.
- Alas, the footer in Graylog is not configured, and forcibly shows software versions instead!
- I implemented a mod_substitute rule in the front-end web server to replace this text (rewrite part of the client on the fly), because couldn't find simpler way to change the default behaviour.
Issue 2:
- Graylog has a refined ACL system, and is apparently meant to be used by users of different roles, and access rights. Users may vary from full fledged administrators to non-IT trained personnel that are tasked to search for pre-defined records.
- While showing information about the system's internals is useful for Administrators, it breaks the principle of least privilege (see for example [NIST SP 800-14](csrc.nist.gov/publications/nistpubs/800-14/800-14.pdf)) by telling end users information they do not require in their tasks.
- In fact, showing the version information for internal components gives potentially malicious users information that may assist in their non-sanctioned activities. Thus, showing this information to non-administrators is generally frowned upon, and handled as (low severity) security incident in security audits.
### Proposal
Add configuration options and/or change the default behaviour. For example show the current information to administrator, but show non-admin users a configurable disclaimer.
Probably also the login screen should be able to show the same disclaimer?
Contributor guide
Assessment
This issue has not been assessed yet.