Add license check for FIPS #181187

kc13greiner · 2024-04-18T17:35:25Z

Updates

Latest updates

Expose whether KB is configured to run in FIPS mode from Core -> Security

Consolidating all FIPS PRs into this PR

*Previous PRs were Approved

Changes

Config option is now experimental: xpack.security.experimental.fipsMode.enabled
Documentation has been revised
- Listed as an experimental feature
- Added keystore references for adding a password

Summary

Closes #169738
Closes #169739
Closes #169740
Closes #185948

FIPS is a platinum license feature.

KIbana instances must have a platinum or better license to start up in FIPS mode, a lesser license will result in Kibana failing to start up

If the license is degraded, Kibana will still run, but an error will be logged letting the user know that Kibana will not be able to restart.

Config changes

This PR required the changes that were approved from a previous PR, since that PR couldn't be merged into main, I merged it here.

Testing

Locally

In your kibana.dev.yml add: xpack.security.experimental.fipsMode.enabled: true

To allow Kibana to start without actually providing a compliant OpenSSL provider, in x-pack/plugins/security/server/config.ts change L328 from if (isFipsEnabled !== isNodeRunningWithFipsEnabled) to if (false)

You are now configured to run in FIPS-spoof mode!

Run: yarn es snapshot and yarn start > You should see Kibana fail to start with an error about using a basic license.

Run: yarn es snapshot --license trial and yarn start > Kibana should start.

Login as elastic and navigate to Stack Management > License Management

Switch your license to basic and accept.

In your logs, you will see an error letting users know that you no longer have an appropriate license and Kibana will not restart.

For FIPS enthusiasts

Start an ES instance in a method of your choosing, but not using yarn es snapshot. I like to use an 8.15.0-snapshot from the .es/cache directory by running tar -xzvf elasticsearch-8.15.0-SNAPSHOT-darwin-aarch64.tar.gz and cd into the new directory's bin folder to run ./elasticsearch

Ensure you have Docker running locally.

From any command line, run: docker run --rm -it -e XPACK_SECURITY_FIPSMODE_ENABLED='true' -p 5601:5601/tcp docker.elastic.co/kibana-ci/kibana-ubi-fips:8.15.0-SNAPSHOT-bc3150316ed317c08d57c6bd785ba39586072e1d

This will start Kibana into Interactive Setup mode, copy and paste the token from the ES startup logs.

Kibana should fail to start and you should see Kibana fail to start with an error about using a basic license.

Repeat the above process except before you paste the token from ES, do the following to enable a trial license on your ES instance:

In a new terminal window, navigate to your the top level of your elasticsearch folder and run

curl -X POST --cacert config/certs/http_ca.crt -u elastic:YOUR_PASSWORD_HERE "https://localhost:9200/_license/start_trial?acknowledge=true&pretty"

You should receive a successful response.

Now paste the token from the ES startup logs into the Kibana Interactive Setup window and Kibana should start.

Login as elastic and navigate to Stack Management > License Management

Switch your license to basic and accept.

In your logs, you will see an error letting users know that you no longer have an appropriate license and Kibana will not restart.

…S is enabled in KB and Node

… error for this test

kc13greiner · 2024-04-18T17:35:33Z

/ci

kc13greiner · 2024-04-18T19:41:16Z

/ci

kc13greiner · 2024-04-18T20:26:21Z

/ci

kc13greiner · 2024-04-23T11:41:57Z

/ci

kc13greiner · 2024-04-23T12:42:08Z

/ci

kc13greiner · 2024-04-23T18:49:18Z

/ci

…fix'

kc13greiner · 2024-06-20T20:32:33Z

/ci

…fix'

kc13greiner · 2024-06-20T22:15:46Z

/ci

kc13greiner · 2024-06-20T23:02:48Z

/ci

pgayvallet

Core changes looks ok, got a couple questions before approval though:

pgayvallet · 2024-06-24T06:20:39Z

packages/core/security/core-security-server/src/contracts.ts

@@ -6,6 +6,7 @@
 * Side Public License, v 1.
 */

+import { CoreFipsService } from './fips';


NIT: import type

Fixed in 7b7ed01

pgayvallet · 2024-06-24T06:21:31Z

packages/core/security/core-security-server/src/contracts.ts

@@ -21,6 +22,11 @@ export interface SecurityServiceSetup {
   * @remark this should **exclusively** be used by the security plugin.
   */
  registerSecurityDelegate(api: CoreSecurityDelegateContract): void;
+
+  /**
+   * The {{@link CoreFipsService | FIPS service}}


NIT: I don't think doubling {{ }} even works for tsdoc?

Fixed in 7b7ed01

pgayvallet · 2024-06-24T06:27:03Z

packages/core/security/core-security-server-internal/src/security_service.ts

  }

  public setup(): InternalSecurityServiceSetup {
+    const config = this.getConfig();
+    const securityConfig: SecurityServiceConfigType = config.get(['xpack', 'security']);


Oh, yeah... I overlooked we would need to access the security plugin's config from our core service for that feature 🙈.

With our security-in-core initiative, I think we'll want to move the security config from xpack.security.* to core.security.* at some point. It shouldn't be that much work (moving the schema registration + adding config deprecation + exposing the config type from core for the security plugin to be able to use them)

Without doing so, I agree that hacking around and accessing the raw config is the most pragmatic approach. It's absolutely against a dozen Core principles though, so would you mind opening a follow-up issue, just to keep track (and discuss) of moving the security config schema/registration to Core?

Follow up issue: #186863

Ill make a note to update this code once we move the config over

pgayvallet · 2024-06-24T06:27:41Z

packages/core/security/core-security-server-internal/src/fips/fips.ts

+import { SecurityServiceConfigType } from '../utils';
+
+export function isFipsEnabled(config: SecurityServiceConfigType): boolean {
+  return config?.experimental?.fipsMode?.enabled || false;


NIT: ?? false is technically more accurate

Fixed in 7b7ed01

pgayvallet · 2024-06-24T06:28:35Z

packages/core/security/core-security-server-internal/src/fips/fips.test.ts

+    let config: SecurityServiceConfigType;
+
+    beforeAll(() => {
+      config = {};
+    });
+
+    afterEach(() => {
+      config = {};
+    });


NIT: I would ditch that part, given each test manually declare the config it need for its assertion.

Fixed in 7b7ed01

pgayvallet · 2024-06-24T06:41:21Z

src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker

@@ -388,6 +388,7 @@ kibana_vars=(
    xpack.security.authc.selector.enabled
    xpack.security.cookieName
    xpack.security.encryptionKey
+    xpack.security.experimental.fipsMode.enabled


NIT: Thinking out loud there, but are we sure we want that under that experimental prefix instead of just flagging it as experimental in the documentation?

experimental config prefixes means once the feature leaves its experimental state, the config property name changes too, meaning another config deprecation to move it, and overall more work and maintenance.

So yeah, wouldn't documenting the flag as experimental be enough?

I'm torn; I want to really make clear that this config option should not be used at the moment, but I do see what you mean more work/rework.

@legrego @azasypkin What do you think?

I'm quite torn as well. We really do not want this to be exposed/configured yet, and documenting it goes against that goal.

Yeah, I think I'm in the "experimental-in-config-entry-name" camp mostly due to these reasons:

We absolutely don't want anyone outside of Elastic to use or even know about it at this point, no usual "deprecation" flow is assumed. It's experimental in the broadest sense, it can theoretically lead to all sorts of consequences from unexpected downtime to data loss or violated security expectations.

If anyone happens to figure out that such a setting exists and tries to use it before we can commit to supporting FIPS, well, that's on them. But when we're ready to officially support FIPS, we want to make sure they cannot upgrade before they go and read about the scope of FIPS support, expectations, and proper configuration that might potentially include other settings they will need to configure in addition to fipsMode.enabled.

👍 fair enough, thanks for explaining the reasoning

pgayvallet · 2024-06-24T06:48:30Z

x-pack/plugins/security/server/config.ts

+          isNodeRunningWithFipsEnabled ? 'enabled' : 'disabled'
+        }`
+      );
+      process.exit(78);


🙈 I gonna do like I did not saw a plugin's configuration validation call process.exit with a return code not used anywhere else in of our software.

More seriously though, can't this be done at Core's level? I would have way less concerns and issues with Core performing this check (or at least this non-standard process termination). This is done before the license is added to the equation, right? So from my understanding nothing blocks it from being done in Core?

(but if we can't I'll just 🙈)

😅 fair points, I'll take a look to see if there might be a better place for this check in core.

Did you have any place in mind that might be best?

Could this possibly be done in the setup phase of Core's security service (where you added the logic to return the isFIPS API from the contract)?

Done in 2c11610

kc13greiner · 2024-06-25T03:10:31Z

/ci

kc13greiner · 2024-06-26T03:34:31Z

/ci

…fix'

pgayvallet

LGTM

kibana-ci · 2024-07-02T12:56:10Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: 33db0d6
Kibana UBI FIPS Image: docker.elastic.co/kibana-ci/kibana-ubi-fips:8.15.0-SNAPSHOT-33db0d6adb8dea6056608fbacab5461b8d5e152f

Failed CI Steps

Metrics [docs]

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`@kbn/security-plugin-types-common`	58	59	+1
`security`	204	206	+2
total			+3

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`security`	69.5KB	69.6KB	+145.0B

Unknown metric groups

API count

id	before	after	diff
`@kbn/core-security-server`	49	52	+3
`@kbn/security-plugin-types-common`	116	118	+2
`security`	411	415	+4
total			+9

History

💚 Build #217800 succeeded b82345d
💛 Build #217569 was flaky 50015b0
💛 Build #217043 was flaky b7f1de0
💔 Build #217034 failed d468deb
💔 Build #217012 failed d5cd54e

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @kc13greiner

…in CI and Docker (#187533) ## Summary Closes #188272 A check was added to in #181187 which detects if the environment has FIPS enabled NodeJS, but Kibana is not setup properly. This adds the Kibana setting for FIPS in CI and the Docker image. Note there are still license issues on some tests due to #181187 as well, but this will be handled in another PR.

kc13greiner added 11 commits January 9, 2024 18:29

Adding check when getting the config for the sec plugin to verify FIP…

fd898bc

…S is enabled in KB and Node

Merge branch 'main' into feature/add_fips_config

392bee9

changing fips_mode -> fipsMode

eff7830

Merge branch 'main' into feature/add_fips_config

be473ba

Merge branch 'main' into feature/add_fips_config

d6f8f5c

Changing expect to log statement to clarify that it shouldnt throw an…

eccc9e9

… error for this test

Merge branch 'main' into feature/add_fips_config

ea425ec

Merge branch 'main' into feature/add_fips_config

d2cc083

Merge branch 'main' into feature/add_fips_config

b65471c

Merge branch 'feature/add_fips_config' into feature/fips_license_check

a0b72e6

Adding license check for FIPS

683531c

kc13greiner added Team:Security Team focused on: Auth, Users, Roles, Spaces, Audit Logging, and more! release_note:skip Skip the PR/issue when compiling release notes backport:skip This commit does not require backporting labels Apr 18, 2024

kc13greiner self-assigned this Apr 18, 2024

kc13greiner added 2 commits April 18, 2024 15:40

Removing unused line in snapshot

03f4b9e

Merge branch 'main' into feature/fips_license_check

ff51670

Adding new property

8959fbb

kc13greiner added 2 commits April 23, 2024 07:41

Refactoring usage of License in favor of just using SecurityLicense

d50f7c5

Merge branch 'main' into feature/fips_license_check

b1fa762

kc13greiner added 2 commits April 23, 2024 08:41

Removing console logs

9d4d035

Merge branch 'main' into feature/fips_license_check

fd58057

kc13greiner added 2 commits April 23, 2024 14:47

Fixing jest tests

16d7ad8

Merge branch 'main' into feature/fips_license_check

2bee3ea

lcawl and others added 2 commits June 18, 2024 08:51

Merge branch 'main' into feature/fips_license_check

90050f1

Exposing fips flag from core

57c2f36

kc13greiner requested a review from a team as a code owner June 20, 2024 17:58

kibanamachine and others added 3 commits June 20, 2024 18:11

[CI] Auto-commit changed files from 'node scripts/lint_ts_projects --…

ff3586a

…fix'

Fixing config type and adding tests

31b7546

Merge branch 'main' into feature/fips_license_check

7b1a16a

kibanamachine and others added 3 commits June 20, 2024 20:44

[CI] Auto-commit changed files from 'node scripts/lint_ts_projects --…

d5cd54e

…fix'

fixing mocks

19244c4

Merge branch 'main' into feature/fips_license_check

d468deb

Removing tests

b7f1de0

pgayvallet reviewed Jun 24, 2024

View reviewed changes

kc13greiner added 2 commits June 24, 2024 23:09

PR feedback from Pierre

7b7ed01

Merge branch 'main' into feature/fips_license_check

50015b0

kc13greiner added 2 commits June 25, 2024 23:31

Moving FIPS config comparison check to Core > Security Service setup

2c11610

Merge branch 'main' into feature/fips_license_check

fccc836

[CI] Auto-commit changed files from 'node scripts/lint_ts_projects --…

b82345d

…fix'

pgayvallet approved these changes Jun 27, 2024

View reviewed changes

Merge branch 'main' into feature/fips_license_check

33db0d6

kc13greiner merged commit 4554b75 into elastic:main Jul 2, 2024
24 checks passed

kibanamachine added the v8.15.0 label Jul 2, 2024

Ikuni17 mentioned this pull request Jul 4, 2024

[CI / Build / FIPS] Use xpack.security.experimental.fipsMode.enabled in CI and Docker #187533

Merged

This was referenced Jul 13, 2024

[FIPS] Agents fail to start due to new experimental setting #188272

Closed

[FIPS] Tests failing due to license checks #188273

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add license check for FIPS #181187

Add license check for FIPS #181187

kc13greiner commented Apr 18, 2024 •

edited

Loading

kc13greiner commented Apr 18, 2024

kc13greiner commented Apr 18, 2024

kc13greiner commented Apr 18, 2024

kc13greiner commented Apr 23, 2024

kc13greiner commented Apr 23, 2024

kc13greiner commented Apr 23, 2024

kc13greiner commented Jun 20, 2024

kc13greiner commented Jun 20, 2024

kc13greiner commented Jun 20, 2024

pgayvallet left a comment •

edited

Loading

pgayvallet Jun 24, 2024

kc13greiner Jun 25, 2024

pgayvallet Jun 24, 2024

kc13greiner Jun 25, 2024

pgayvallet Jun 24, 2024

kc13greiner Jun 25, 2024

pgayvallet Jun 24, 2024

kc13greiner Jun 25, 2024

pgayvallet Jun 24, 2024

kc13greiner Jun 25, 2024

pgayvallet Jun 24, 2024

kc13greiner Jun 25, 2024

legrego Jun 25, 2024

azasypkin Jun 28, 2024

pgayvallet Jul 1, 2024

pgayvallet Jun 24, 2024

kc13greiner Jun 25, 2024

pgayvallet Jun 25, 2024

kc13greiner Jun 26, 2024

kc13greiner commented Jun 25, 2024

kc13greiner commented Jun 26, 2024

pgayvallet left a comment

kibana-ci commented Jul 2, 2024 •

edited

Loading

API count

Add license check for FIPS #181187

Add license check for FIPS #181187

Conversation

kc13greiner commented Apr 18, 2024 • edited Loading

Updates

Latest updates

Changes

Summary

Config changes

Testing

Locally

For FIPS enthusiasts

kc13greiner commented Apr 18, 2024

kc13greiner commented Apr 18, 2024

kc13greiner commented Apr 18, 2024

kc13greiner commented Apr 23, 2024

kc13greiner commented Apr 23, 2024

kc13greiner commented Apr 23, 2024

kc13greiner commented Jun 20, 2024

kc13greiner commented Jun 20, 2024

kc13greiner commented Jun 20, 2024

pgayvallet left a comment • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kc13greiner commented Jun 25, 2024

kc13greiner commented Jun 26, 2024

pgayvallet left a comment

Choose a reason for hiding this comment

kibana-ci commented Jul 2, 2024 • edited Loading

💛 Build succeeded, but was flaky

Failed CI Steps

Metrics [docs]

Public APIs missing comments

Page load bundle

API count

History

kc13greiner commented Apr 18, 2024 •

edited

Loading

pgayvallet left a comment •

edited

Loading

kibana-ci commented Jul 2, 2024 •

edited

Loading