Disable changes in audit configuration

Security
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): OpenSearch version 3.3.2 (but we’re going to 3.4 really soon)

Describe the issue:

I’m developing an OpenSearch plugin. One of my requirements is to ensure that audit logs are enabled in OpenSearch (the whole time the cluster is running).

I know that there is a way to configure auditlogs via opensearch.yml and audit.yml and also via REST API. So in my plugin I can check those files but the REST API is a challenge for me. How to ensure nobody disabled audit logs via REST?

Of course I know that I can restrict the access to the endpoint by watching out what kind of users and with what permissions are being created. However I fear it’s not enough.

The other solution I found the other day is _readonly field. If I understand it correctly - this is a way to configure what parameters of an audit configuration cannot be changed. It looks like something I want but I’m not entirely sure how should I use it? The only way I can see now how to use it is: clone whole security plugin, modify static_audit.yml, build the security plugin and then install it in OpenSearch.

Is it the only way to use it?

The solution of the last resort for me is to watch for transport action that updates an audit config and then do GET requests to security API to validate if by any chance audit was disabled. It pains me but what more can I do?

…or maybe there is some other way to achieve what I have in mind?

I’m open to any suggestions, if, by any chance, something could be added to security plugin to achieve what I have in mind I’m open to contributing myself.

Thanks!

Configuration:

Relevant Logs or Screenshots:

2

@zuuz94 Have you tried API access control?

For example,

plugins.security.restapi.roles_enabled: [all_access, security_rest_api_access]

Will allow only users in the listed groups to run any security plugin APIs.

curl --insecure -u pablo:Eliatra123 -H "Content-Type: application/json" -XPUT https://localhost:9200/_plugins/_security/api/audit/config -d '{"enabled": false}'

{"status":"FORBIDDEN","message":"No permission to access REST API: User pablo with Security roles [own_index, kibana_user] does not have any role privileged for admin access. No client TLS certificate found in request"}


 curl --insecure -u admin:Eliatra123 -H "Content-Type: application/json" -XPUT https://localhost:9200/_plugins/_security/api/audit/config -d '{"enabled": false}'

{"status":"OK","message":"'config' updated."}pablo@docker1:~$
3

@pablo I wasn’t aware of this functionality, definitely I’ll check it out!

And out of curiosity - do I understand this configuration of _readonly correctly? In order to use it I need to build the security plugin on my own?