February 2017 Summaries

Authorization logs on Linux systems, found in paths such as /var/log/auth.log for Debian-based and /var/log/secure for RedHat-based systems, provide critical security-related information, including SSH logins, sudo attempts, and user and group creation events. These logs are generated by the Syslog server using the syslog format, with each line's message varying depending on the originating program. Parsing these logs with Grok patterns can reveal patterns in SSH attacks, such as brute force attempts that often involve common usernames like root, ubuntu, and admin. By analyzing GeoIP data, the origin of these attacks can be identified, with significant attempts coming from regions like China, the US, and Europe. Sudo logs also offer insights into commands executed with superuser privileges and potential security breaches if unauthorized attempts are made. Monitoring user and group creation logs helps ensure new accounts are appropriately configured, particularly concerning shell access and home directories. The implementation of Filebeat modules promises to streamline the process of log collection, parsing, indexing, and visualization, enabling users to manage these logs efficiently with a single command in future releases.

Elasticsearch 5.2.2, released on February 28, 2017, is the latest stable release in the 5.x series and is based on Lucene 6.4.1, available for deployment on Elastic Cloud. This release includes minor bug fixes, with notable improvements such as a fix for the request circuit breaker issue that prevented further requests after a client prematurely closed a connection, and a regex bug fix in the cgroup functionality that affected nodes with multiple hierarchies. Additionally, the release addresses unauthorized request rejections caused by shard lock delays and the removal of an undocumented syntax for include/exclude parameters in terms aggregation that affected Kibana. Users are encouraged to upgrade to this version, provide feedback on social media or forums, and report any issues on GitHub.

X-Pack Security is a robust system for securing Elasticsearch clusters, offering authentication and authorization through Role-Based Access Control (RBAC) and various built-in realms like Native, LDAP, and Active Directory. For cases where third-party authentication systems are needed, users can either create a custom realm or employ a reverse proxy alongside X-Pack Security's impersonation feature. This setup, demonstrated using Google Sign-In, Bitly's oauth2_proxy, and Nginx, allows for seamless integration with Kibana by translating third-party credentials into X-Pack Security's Native realm users and managing authorization. The guide emphasizes the importance of securing such configurations for production environments by implementing TLS, hardening proxies, and defining restrictive user roles. X-Pack Security's impersonation capability extends beyond Native realm users to support LDAP and Active Directory, offering flexibility for integrating various authentication services.

The Kibana team addresses the challenge of writing scalable CSS by adopting a component-based approach, using classes and the BEM naming convention to create predictable and readable markup. By constructing user interfaces from components like buttons and panels, the team simplifies CSS, making it easier to maintain and avoiding complex selector dependencies that can lead to errors. The use of single-class selectors helps clarify the relationship between elements and reduces the risk of unintentional style changes. To manage CSS inheritance issues, the team applies inherited properties only to "leaf" nodes that do not contain child elements. This structured approach is designed to improve both the readability of markup and the efficiency of UI development. The blog post is part of a series that will continue with a focus on writing JavaScript with React for component reusability and composability.

Elastic{ON} 2017 is a conference designed to maximize the attendee's experience by offering a range of sessions, opportunities for networking, and engaging activities. Participants are encouraged to prepare by reviewing the agenda and attending pre-conference training to familiarize themselves with the Elastic Stack. Attendees are advised to step out of their comfort zones by attending unexpected sessions, engaging in conversations with peers, and actively participating in Birds of a Feather meetups. The conference also features an AMA booth for addressing queries, small breakout sessions for niche interests, and a women's breakfast for networking. Additional highlights include after-parties at the California Academy of Sciences and ample opportunities to interact with Elastic staff and community members. With a variety of activities and gourmet food options, the event aims to provide a valuable and enjoyable experience for all participants.

Michael McCandless discusses advancements in handling multi-token synonyms and graph queries in Elasticsearch, highlighting the transition from SynonymFilter to the new SynonymGraphFilter in Lucene 6.4.0, as included in Elasticsearch 5.2.0. This update addresses longstanding limitations by accurately preserving token graph structures during search-time rather than index-time, enabling accurate query results even with complex synonyms. The improvements also involve changes to query parsers, allowing them to recognize and process token graphs accurately, which resolves issues with phrase queries and enhances flexibility without requiring re-indexing. Additional optimizations in QueryBuilder, such as analyzing articulation points to streamline BooleanQuery creation, are introduced in Lucene 6.5.0. The article also notes upcoming changes to other token filters like WordDelimiterGraphFilter and highlights ongoing challenges, including the need for SynonymGraphFilter to consume graphs and the complexities of implementing these solutions given current APIs.

Elasticsearch 5.2.1, based on Lucene 6.4.1, has been released and is now available for deployment on Elastic Cloud, with users encouraged to upgrade. This release includes mostly minor bug fixes, but importantly addresses two significant memory leaks in Lucene: one related to the use of Deflater/Inflater instances with best_compression, which was causing issues with native memory usage, and another concerning cached queries retaining references to IndexReader, preventing timely segment deletion. Users are invited to download the new version, provide feedback via Twitter or forums, and report any issues on GitHub.

Daniel Mitterdorfer describes how a Jenkins-based continuous integration setup running on SuSE Enterprise Linux 12 SP2 encountered a java.lang.OutOfMemoryError due to the JVM's inability to create new native threads during Elasticsearch builds. The problem was isolated to the system's thread safety margin and process limits, particularly related to the cgroup process number controller managed by systemd. Despite initially attempting to adjust the JVM's thread safety margin and investigating system limits like maximum user processes and thread counts, the solution was ultimately found by increasing the cgroup's process limit for the Jenkins slave process from a conservative 512 to 4096. This adjustment allowed the build process to succeed, highlighting the importance of understanding and configuring system resource limits in complex build environments.

The blog post provides a detailed guide on implementing in-transit encryption for the Elastic Stack using Let's Encrypt certificates and X-Pack Security. It emphasizes the importance of encrypting HTTP transport-level communications to protect against data theft, and introduces Let's Encrypt as a cost-effective Certificate Authority. The guide explains how to obtain and use certificates with Certbot, a tool that facilitates the process through the ACME framework by verifying domain control. It covers the necessary steps for configuring Elasticsearch and Kibana to use SSL/TLS encryption, including setting up file permissions, configuring PEM files, and adjusting Elasticsearch and Kibana configuration files. The post also discusses the need to regularly renew Let's Encrypt's short-lived certificates and offers additional tips for managing multi-node clusters. Finally, it mentions the use of dm-crypt for encryption at rest, though this aspect is not covered in detail.

Elasticsearch's failover capabilities rely on maintaining multiple copies of data within a cluster, primarily through a primary-backup model where the primary shard handles all indexing operations and replicates changes to replica shards. This system ensures data safety even amidst network disruptions or node failures by promoting the most recent in-sync shard copies to primary status when needed. Shard allocation is managed by the master node, which records allocation decisions in the cluster state, enabling smart routing and ensuring only the latest data copies are used as primaries. In cases of network issues or node failures, if replicas miss updates, they are marked as stale and removed from the in-sync set to prevent data loss. Elasticsearch maintains write availability by updating the in-sync set via its consensus layer, ensuring that only fully updated copies can become primary. In extreme situations where all in-sync copies are lost, Elasticsearch provides manual commands to allocate stale or empty shard copies, though these measures involve data loss and are recommended only as last resorts.

In February 2017, Elastic co-founder Steven Schuurman announced his decision to step down as CEO, with fellow co-founder Shay Banon set to succeed him on May 1, 2017. Schuurman expressed his belief that Banon, a long-time partner in the company's journey, is the right visionary leader to guide Elastic through its next phase of growth. Schuurman, who will remain on Elastic's Board of Directors in a non-executive role, reflected on the strong relationship and transparent collaboration he shared with Banon while co-piloting the company. Banon expressed gratitude for their flexible partnership and emphasized his commitment to leading Elastic as it continues its global expansion, supported by an active community and a strong team. Both founders paid tribute to their co-founders, the executive team, and investors for their support and contributions to Elastic's success.