Add documentation for score based password estimator settings (#4267)
* fix#4088 score based pw estimator Signed-off-by: cwillum <cwmmoore@amazon.com> * fix#4088 score based pw estimator Signed-off-by: cwillum <cwmmoore@amazon.com> * fix#4088 score based pw estimator Signed-off-by: cwillum <cwmmoore@amazon.com> * fix#4088 score based pw estimator Signed-off-by: cwillum <cwmmoore@amazon.com> * fix#4088 score based pw estimator Signed-off-by: cwillum <cwmmoore@amazon.com> --------- Signed-off-by: cwillum <cwmmoore@amazon.com>
This commit is contained in:
Chris Moore
GitHub
parent
4b6e637627
commit
12d04a1378
|
|
@ -120,6 +120,22 @@ plugins.security.system_indices.indices: [".opendistro-alerting-config", ".opend
|
|||
node.max_local_storage_nodes: 3
|
||||
```
|
||||
|
||||
### Refining your configuration
|
||||
|
||||
The `plugins.security.allow_default_init_securityindex` setting, when set to `true`, sets the Security plugin to its default security settings if an attempt to create the security index fails when OpenSearch launches. Default security settings are stored in YAML files contained in the `opensearch-project/security/config` directory. By default, this setting is `false`.
|
||||
|
||||
```yml
|
||||
plugins.security.allow_default_init_securityindex: true
|
||||
```
|
||||
|
||||
An authentication cache for the Security plugin exists to help speed up authentication by temporarily storing user objects returned from the backend so that the Security plugin is not required to make repeated requests for them. To determine how long it takes for caching to time out, you can use the `plugins.security.cache.ttl_minutes` property to set a value in minutes. The default is `60`. You can disable caching by setting the value to `0`.
|
||||
|
||||
```yml
|
||||
plugins.security.cache.ttl_minutes: 60
|
||||
```
|
||||
|
||||
### Password settings
|
||||
|
||||
If you want to run your users' passwords against some validation, specify a regular expression (regex) in this file. You can also include an error message that loads when passwords don't pass validation. The following example demonstrates how to include a regex so OpenSearch requires new passwords to be a minimum of eight characters with at least one uppercase, one lowercase, one digit, and one special character.
|
||||
|
||||
Note that OpenSearch validates only users and passwords created through OpenSearch Dashboards or the REST API.
|
||||
|
|
@ -129,16 +145,36 @@ plugins.security.restapi.password_validation_regex: '(?=.*[A-Z])(?=.*[^a-zA-Z\d]
|
|||
plugins.security.restapi.password_validation_error_message: "Password must be minimum 8 characters long and must contain at least one uppercase letter, one lowercase letter, one digit, and one special character."
|
||||
```
|
||||
|
||||
The opensearch.yml file also contains the `plugins.security.allow_default_init_securityindex` property. When set to `true`, the Security plugin uses default security settings if an attempt to create the security index fails when OpenSearch launches. Default security settings are stored in YAML files contained in the `opensearch-project/security/config` directory. By default, this setting is `false`.
|
||||
In addition, a score-based password strength estimator allows you to set a threshold for password strength when creating a new internal user or updating a user's password. This feature makes use of the [zxcvbn library](https://github.com/dropbox/zxcvbn) to apply a policy that emphasizes a password's complexity rather than its capacity to meet traditional criteria such as uppercase keys, numerals, and special characters.
|
||||
|
||||
For information about creating users, see [Create users]({{site.url}}{{site.baseurl}}/security/access-control/users-roles/#create-users).
|
||||
|
||||
This feature is not compatible with users specified as reserved. For information about reserved resources, see [Reserved and hidden resources]({{site.url}}{{site.baseurl}}/security/access-control/api#reserved-and-hidden-resources).
|
||||
{: .important }
|
||||
|
||||
Score-based password strength requires two settings to configure the feature. The following table describes the two settings.
|
||||
|
||||
| Setting | Description |
|
||||
| :--- | :--- |
|
||||
| `plugins.security.restapi.password_min_length` | Sets the minimum number of characters for the password length. The default is `8`. This is also the minimum. |
|
||||
| `plugins.security.restapi.password_score_based_validation_strength` | Sets a threshold to determine whether the password is strong or weak. There are four values that represent a threshold's increasing complexity.<br>`fair`--A very "guessable" password: provides protection from throttled online attacks.<br>`good`--A somewhat guessable password: provides protection from unthrottled online attacks.<br>`strong`--A safely "unguessable" password: provides moderate protection from an offline, slow-hash scenario.<br>`very_strong`--A very unguessable password: provides strong protection from an offline, slow-hash scenario. |
|
||||
|
||||
The following example shows the settings configured for the `opensearch.yml` file and enabling a password with a minimum of 10 characters and a threshold requiring the highest strength:
|
||||
|
||||
```yml
|
||||
plugins.security.allow_default_init_securityindex: true
|
||||
plugins.security.restapi.password_min_length: 10
|
||||
plugins.security.restapi.password_score_based_validation_strength: very_strong
|
||||
```
|
||||
|
||||
Authentication cache for the Security plugin exists to help speed up authentication by temporarily storing user objects returned from the backend so that the Security plugin is not required to make repeated requests for them. To determine how long it takes for caching to time out, you can use the `plugins.security.cache.ttl_minutes` property to set a value in minutes. The default is `60`. You can disable caching by setting the value to `0`.
|
||||
When you try to create a user with a password that doesn't reach the specified threshold, the system generates a "weak password" warning, indicating that the password needs to be modified before you can save the user.
|
||||
|
||||
```yml
|
||||
plugins.security.cache.ttl_minutes: 60
|
||||
The following example shows the response from the [Create user]({{site.url}}{{site.baseurl}}/security/access-control/api/#create-user) API when the password is weak:
|
||||
|
||||
```json
|
||||
{
|
||||
"status": "error",
|
||||
"reason": "Weak password"
|
||||
}
|
||||
```
|
||||
|
||||
## allowlist.yml
|
||||
|
|
|
|||
Loading…
Reference in New Issue