elastic / elastic/fleet-server
Password Protected Fleet Keystore for Sensitive Credentials
- Dominant language
- Go
- Stars
- 113
- Forks
- 117
- Avg merge
- 1d 16h
- Merged PRs (30d)
- 112
Description
**Describe the enhancement:**
A more secure way to store sensitive credentials for enrollment purposes that can be utilized in an Ansible playbook (capable of automation).
**Describe a specific use case for the enhancement or feature:**
There's a common gotcha point when it comes to hardening in regards to exposed sensitive credentials. It's a potential blocking point if it can’t pass the security checks. While we are a ways out towards deploying with Fleet in production
The current process of Fleet enrollment with tls/ssl enabled involves a command that's like this:
```
elastic-agent enroll --force \
--url=https://fleethost.example.com:8220/ \
--fleet-server-es=https://eshost.example.com:9200/ \
--fleet-server-service-token=AAEAAWVsYXN0a2VAWERva2VuLTE2OTY4NzA3MDI4Njk6MGR0UXg2bXlROGlpQjNCOGR2ZHNjUQ \
--fleet-server-policy=fleet-server-policy \
--certificate-authorities=/etc/elastic-agent/example-cert-chain.pem \
--fleet-server-es-ca=/etc/elastic-agent/example-es-cert.crt \
--fleet-server-cert=/etc/elastic-agent/example-host-cert.crt \
--fleet-server-cert-key=/etc/elastic-agent/example-host-private-key.pem \
--fleet-server-cert-key-passphrase=/etc/elastic-agent/keypass \
--tag=fleet-host
```
The main point of concern is the passphrase is stored in a plaintext file.
```
--fleet-server-cert-key=/etc/elastic-agent/example-host-private-key.pem \
--fleet-server-cert-key-passphrase=/etc/elastic-agent/keypass
```
We are following the [documented steps](https://www.elastic.co/guide/en/fleet/current/secret-files-guide.html#_file_permissions) to secure it as a file within /etc/elastic-agent/ but would like to see the possibility of storing sensitive credentials similar to the [elasticsearch keystore](https://www.elastic.co/guide/en/elasticsearch/reference/current/elasticsearch-keystore.html).
**What is the definition of done?**
The method of storing a private key password meets the criteria of OS & application hardening per STIGs
https://www.stigviewer.com/stig/general_purpose_operating_system_security_requirements_guide/2023-05-17/finding/V-203630
https://www.stigviewer.com/stig/general_purpose_operating_system_security_requirements_guide/2023-05-17/finding/V-203629
https://www.stigviewer.com/stig/application_security_requirements_guide/2011-12-28/finding/V-26924
https://www.stigviewer.com/stig/application_security_requirements_guide/2011-12-28/finding/V-26923
https://www.stigviewer.com/stig/application_security_and_development/2017-01-09/finding/V-70157
Contributor guide
Assessment
This issue has not been assessed yet.