Elastic on Samarthya

Elastic: Realms

Wed, 27 May 2020 00:00:00 +0000

In this blog we will try to setup a realm for elastic authentication.

yum -y install openldap-clients openldap-servers

mymachine>systemctl start slapd
mymachine>systemctl enable slapd
Created symlink from /etc/systemd/system/multi-user.target.wants/slapd.service to /usr/lib/systemd/system/slapd.service.

mymachine>slappasswd
New password: 
Re-enter new password: 
{SSHA}R5nPS+zItZsQrfsw+PIQSNnEiMpLcwLs

mymachine>vi /etc/openldap/slapd.d/cn=config/olcDatabase={2}hdb.ldif

# AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify.
# CRC32 975a66fa
dn: olcDatabase={2}hdb
objectClass: olcDatabaseConfig
objectClass: olcHdbConfig
olcDatabase: {2}hdb
olcDbDirectory: /var/lib/ldap
olcSuffix: dc=my-domain,dc=com
olcRootDN: cn=Manager,dc=my-domain,dc=com
olcDbIndex: objectClass eq,pres
olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub
structuralObjectClass: olcHdbConfig
entryUUID: 64a2a5de-3438-103a-8e85-c1c4cc3ef35f
creatorsName: cn=config
createTimestamp: 20200527073533Z
entryCSN: 20200527073533.541185Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20200527073533Z

mymachine>firewall-cmd --add-service=ldap
success

mymachine>vi ldaproot.ldif

dn: olcDatabase={0}config,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {SSHA}R5nPS+zItZsQrfsw+PIQSNnEiMpLcwLs

mymachine>ldapadd -Y EXTERNAL -H ldapi:/// -f ldaproot.ldif 
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "olcDatabase={0}config,cn=config"

mymachine>cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
mymachine>chown -R ldap:ldap /var/lib/ldap/DB_CONFIG
mymachine>systemctl restart slapd
mymachine>ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=cosine,cn=schema,cn=config"

mymachine>ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=nis,cn=schema,cn=config"

mymachine>ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=inetorgperson,cn=schema,cn=config"

vi ldapdomain.ldif

dn: olcDatabase={1}monitor,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth"
 read by dn.base="cn=Manager,dc=samarthya,dc=com" read by * none

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=samarthya,dc=com

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=Manager,dc=samarthya,dc=com

dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {SSHA}R5nPS+zItZsQrfsw+PIQSNnEiMpLcwLs

dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcAccess
olcAccess: {0}to attrs=userPassword,shadowLastChange by
 dn="cn=Manager,dc=samarthya,dc=com" write by anonymous auth by self write by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to * by dn="cn=Manager,dc=samarthya,dc=com" write by * read

mymachine>ldapmodify -Y EXTERNAL -H ldapi:/// -f ldapdomain.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "olcDatabase={1}monitor,cn=config"

modifying entry "olcDatabase={2}hdb,cn=config"

modifying entry "olcDatabase={2}hdb,cn=config"

modifying entry "olcDatabase={2}hdb,cn=config"

modifying entry "olcDatabase={2}hdb,cn=config"

mymachine>vi baseldapdomain.ldif

dn: dc=samarthya,dc=com
objectClass: top
objectClass: dcObject
objectclass: organization
o: samarthya com
dc: samarthya

dn: cn=Manager,dc=samarthya,dc=com
objectClass: organizationalRole
cn: Manager
description: Directory Manager

dn: ou=People,dc=samarthya,dc=com
objectClass: organizationalUnit
ou: People

dn: ou=Group,dc=samarthya,dc=com
objectClass: organizationalUnit
ou: Group

mymachine>ldapadd -x -D cn=Manager,dc=samarthya,dc=com -W -f baseldapdomain.ldif
Enter LDAP Password: 
adding new entry "dc=samarthya,dc=com"

adding new entry "cn=Manager,dc=samarthya,dc=com"

adding new entry "ou=People,dc=samarthya,dc=com"

adding new entry "ou=Group,dc=samarthya,dc=com"

dn: cn=Manager,ou=Group,dc=samarthya,dc=com
objectClass: top
objectClass: posixGroup
gidNumber: 1009

ldapadd -x -W -D "cn=Manager,dc=samarthya,dc=com" -f ldapgroup.ldif
Enter LDAP Password: 
adding new entry "cn=Manager,ou=Group,dc=samarthya,dc=com"

mymachine>useradd samarthya
mymachine>passwd samarthya
Changing password for user samarthya.

mymachine>ldapadd -x -D cn=Manager,dc=samarthya,dc=com -W -f ldauser.ldif
Enter LDAP Password: 
adding new entry "uid=samarthya,ou=People,dc=samarthya,dc=com"

dn: uid=samarthya,ou=People,dc=samarthya,dc=com
objectClass: top
objectClass: account
objectClass: posixAccount
objectClass: shadowAccount
cn: samarthya
uid: samarthya
uidNumber: 1005
gidNumber: 1005
homeDirectory: /home/samarthya
userPassword: {SSHA}R5nPS+zItZsQrfsw+PIQSNnEiMpLcwLs
loginShell: /bin/bash
gecos: samarthya
shadowLastChange: 0
shadowMax: 0
shadowWarning: 0

Installing phpLdap
#

yum install php-ldap php-mbstring php-pear php-xml

https://www.digitalocean.com/community/tutorials/how-to-install-linux-nginx-mysql-php-lemp-stack-on-centos-7

Elastic: _security API

Thu, 21 May 2020 00:00:00 +0000

Kibana is an effective way of managing users; but as a programmer you always need an API.

It helps to integrate with other applications you are building
Quick and clean way without any cosmetics

> GET /_security/_authenticate HTTP/1.1
> Host: myserver.elastic.node:9200
> Authorization: Basic ABCDEFGHIJKLMNOP==
> User-Agent: insomnia/7.1.1
> Accept: */*

< HTTP/1.1 200 OK
< content-type: application/json; charset=UTF-8
< content-length: 236

* Received 236 B chunk
* Connection #2 to host myserver.elastic.node left intact

GET https://myserver.elastic.node:9200/_security/_authenticate

I have added basic authentication to quickly check

Cluster: Elastic 7.3

Tue, 14 Apr 2020 00:00:00 +0000

What is intriguing about elastic stack is that; it can do so many things that it simplifies the life of a security analyst. The uphill task is to learn the technology itself, but once you have mastered it, things are much easier.

Snapshot & Restore

Wed, 26 Feb 2020 08:58:21 +0000

If you have a production grade elastic cluster it is always recommended to do a regular backup as a standard practice.

Snapshot is a backup of information, that can be be used to restore the last known good state of the system

SIEM: Security Information and Event Management.

Tue, 11 Feb 2020 10:42:16 +0000

Data is key to any analytics, and if it can be organized, normalized and made available for correlated analysis, the results will be more concise. Elastic.co has a SIEM UI and the XPack security pack that helps the new age security analysts.

Elastic Cluster API

Thu, 06 Feb 2020 00:00:00 +0000

Elastic Stack Monitoring Service is available with XPack only.

GET _cluster/settings

{
“persistent” : {
“xpack” : {
“monitoring” : {
“elasticsearch” : {
“collection” : {
“enabled” : “false”
}
},
“collection” : {
“enabled” : “true”
}
}
}
},
“transient” : { }
}

Metric Beat

Fri, 24 Jan 2020 12:00:00 +0000

All right, its been a busy week and finally some time at hand to write about something I have been doing.

Mostly I am working on ELK stack these days, securing, validating, data analytics etc. Today, had the opportunity to go the Secure Elastic way, by enabling the TLS for secure communication within Nodes (Elastic cluster) and finally setup a Metric beat to get the status of the node.

Securing Elastic

Thu, 23 Jan 2020 12:00:00 +0000

Security is integral to every and all the tasks in a shared environment. In ELK if you have setup a cluster which is accessible to all; anyone can make modifications which may or may not impact the other users.

Security Analytics

Mon, 13 Jan 2020 00:00:00 +0000

* Header image from Elastic.co

As we move towards the micro-service/container economy where there are heaps of products available in form of applications to be downloaded & installed on primarily two platforms Android and IOS, we just cant underline the security implications enough.