Perhaps I can redirect myself out of this long nightmare
This commit is contained in:
parent
d80ce75e1c
commit
51017f3bcc
|
@ -7,6 +7,7 @@ has_toc: false
|
|||
redirect_from:
|
||||
- /docs/opensearch-dashboards/
|
||||
- /opensearch-dashboards/
|
||||
- /dashboards/
|
||||
---
|
||||
|
||||
# OpenSearch Dashboards
|
||||
|
|
|
@ -3,6 +3,8 @@ layout: default
|
|||
title: Install OpenSearch Dashboards
|
||||
nav_order: 1
|
||||
has_children: true
|
||||
redirect_from:
|
||||
- /dashboards/install/
|
||||
---
|
||||
|
||||
# Install and configure OpenSearch Dashboards
|
||||
|
|
|
@ -3,6 +3,8 @@ layout: default
|
|||
title: About Index Management
|
||||
nav_order: 1
|
||||
has_children: false
|
||||
redirect_from:
|
||||
- /im-plugin/
|
||||
---
|
||||
|
||||
# About Index Management
|
||||
|
|
|
@ -3,6 +3,8 @@ layout: default
|
|||
title: Anomaly detection
|
||||
nav_order: 46
|
||||
has_children: true
|
||||
redirect_from:
|
||||
- /monitoring-plugins/ad/
|
||||
---
|
||||
|
||||
# Anomaly detection
|
||||
|
|
|
@ -27,7 +27,7 @@ If these roles don't meet your needs, mix and match individual anomaly detection
|
|||
|
||||
Use backend roles to configure fine-grained access to individual detectors based on roles. For example, users of different departments in an organization can view detectors owned by their own department.
|
||||
|
||||
First, make sure your users have the appropriate [backend roles]({{site.url}}{{site.baseurl}}/security-plugin/access-control/). Backend roles usually come from an [LDAP server]({{site.url}}{{site.baseurl}}/security-plugin/configuration/ldap/) or [SAML provider]({{site.url}}{{site.baseurl}}/security-plugin/configuration/saml/), but if you use the internal user database, you can use the REST API to [add them manually]({{site.url}}{{site.baseurl}}/security-plugin/access-control/api#create-user).
|
||||
First, make sure your users have the appropriate [backend roles]({{site.url}}{{site.baseurl}}/security-plugin/access-control/index/). Backend roles usually come from an [LDAP server]({{site.url}}{{site.baseurl}}/security-plugin/configuration/ldap/) or [SAML provider]({{site.url}}{{site.baseurl}}/security-plugin/configuration/saml/), but if you use the internal user database, you can use the REST API to [add them manually]({{site.url}}{{site.baseurl}}/security-plugin/access-control/api#create-user).
|
||||
|
||||
Next, enable the following setting:
|
||||
|
||||
|
|
|
@ -3,6 +3,8 @@ layout: default
|
|||
title: Alerting
|
||||
nav_order: 34
|
||||
has_children: true
|
||||
redirect_from:
|
||||
- /monitoring-plugins/alerting/
|
||||
---
|
||||
|
||||
# Alerting
|
||||
|
|
|
@ -36,7 +36,7 @@ After making the change, the monitor now runs with the same permissions as `psan
|
|||
|
||||
Out of the box, the alerting plugin has no concept of ownership. For example, if you have the `cluster:admin/opensearch/alerting/monitor/write` permission, you can edit *all* monitors, regardless of whether you created them. If a small number of trusted users manage your monitors and destinations, this lack of ownership generally isn't a problem. A larger organization might need to segment access by backend role.
|
||||
|
||||
First, make sure that your users have the appropriate [backend roles]({{site.url}}{{site.baseurl}}/security-plugin/access-control/). Backend roles usually come from an [LDAP server]({{site.url}}{{site.baseurl}}/security-plugin/configuration/ldap/) or [SAML provider]({{site.url}}{{site.baseurl}}/security-plugin/configuration/saml/). However, if you use the internal user database, you can use the REST API to [add them manually]({{site.url}}{{site.baseurl}}/security-plugin/access-control/api#create-user).
|
||||
First, make sure that your users have the appropriate [backend roles]({{site.url}}{{site.baseurl}}/security-plugin/access-control/index/). Backend roles usually come from an [LDAP server]({{site.url}}{{site.baseurl}}/security-plugin/configuration/ldap/) or [SAML provider]({{site.url}}{{site.baseurl}}/security-plugin/configuration/saml/). However, if you use the internal user database, you can use the REST API to [add them manually]({{site.url}}{{site.baseurl}}/security-plugin/access-control/api#create-user).
|
||||
|
||||
Next, enable the following setting:
|
||||
|
||||
|
|
|
@ -3,6 +3,8 @@ layout: default
|
|||
title: Performance Analyzer
|
||||
nav_order: 58
|
||||
has_children: true
|
||||
redirect_from:
|
||||
- /monitoring-plugins/pa/
|
||||
---
|
||||
|
||||
# Performance Analyzer
|
||||
|
|
|
@ -4,6 +4,8 @@ title: Trace analytics
|
|||
nav_order: 48
|
||||
has_children: true
|
||||
has_toc: false
|
||||
redirect_from:
|
||||
- /monitoring-plugins/trace/
|
||||
---
|
||||
|
||||
# Trace Analytics
|
||||
|
|
|
@ -335,4 +335,4 @@ If you are using the security plugin, the previous request to `_cat/nodes?v` mig
|
|||
sudo ./securityadmin.sh -cd {{site.url}}{{site.baseurl}}/securityconfig/ -icl -nhnv -cacert /etc/opensearch/root-ca.pem -cert /etc/opensearch/kirk.pem -key /etc/opensearch/kirk-key.pem -h <private-ip>
|
||||
```
|
||||
|
||||
For full guidance around configuration options, see [Security configuration]({{site.url}}{{site.baseurl}}/security-plugin/configuration).
|
||||
For full guidance around configuration options, see [Security configuration]({{site.url}}{{site.baseurl}}/security-plugin/configuration/index/).
|
||||
|
|
|
@ -4,6 +4,8 @@ title: About OpenSearch
|
|||
nav_order: 1
|
||||
has_children: false
|
||||
has_toc: false
|
||||
redirect_from:
|
||||
- /opensearch/
|
||||
---
|
||||
|
||||
# Introduction to OpenSearch
|
||||
|
|
|
@ -108,7 +108,7 @@ networks:
|
|||
opensearch-net:
|
||||
```
|
||||
|
||||
Then make your changes to `opensearch.yml`. For a full list of settings, see [Security]({{site.url}}{{site.baseurl}}/security-plugin/configuration/). This example adds (extremely) verbose audit logging:
|
||||
Then make your changes to `opensearch.yml`. For a full list of settings, see [Security]({{site.url}}{{site.baseurl}}/security-plugin/configuration/index/). This example adds (extremely) verbose audit logging:
|
||||
|
||||
```yml
|
||||
plugins.security.ssl.transport.pemcert_filepath: node.pem
|
||||
|
|
|
@ -183,7 +183,7 @@ services:
|
|||
- ./custom-opensearch_dashboards.yml:/usr/share/opensearch-dashboards/config/opensearch_dashboards.yml
|
||||
```
|
||||
|
||||
You can also configure `docker-compose.yml` and `opensearch.yml` [to take your own certificates]({{site.url}}{{site.baseurl}}/opensearch/install/docker-security/) for use with the [Security]({{site.url}}{{site.baseurl}}/security-plugin/configuration/) plugin.
|
||||
You can also configure `docker-compose.yml` and `opensearch.yml` [to take your own certificates]({{site.url}}{{site.baseurl}}/opensearch/install/docker-security/) for use with the [Security]({{site.url}}{{site.baseurl}}/security-plugin/configuration/index/) plugin.
|
||||
|
||||
|
||||
### (Optional) Set up Performance Analyzer
|
||||
|
|
|
@ -2,7 +2,9 @@
|
|||
layout: default
|
||||
title: Install OpenSearch
|
||||
nav_order: 2
|
||||
redirect_from: /docs/install/
|
||||
redirect_from:
|
||||
- /docs/install/
|
||||
- /opensearch/install/
|
||||
has_children: true
|
||||
---
|
||||
|
||||
|
|
|
@ -3,6 +3,8 @@ layout: default
|
|||
title: Query DSL
|
||||
nav_order: 27
|
||||
has_children: true
|
||||
redirect_from:
|
||||
- /opensearch/query-dsl/
|
||||
---
|
||||
|
||||
# Query DSL
|
||||
|
|
|
@ -3,6 +3,8 @@ layout: default
|
|||
title: REST API reference
|
||||
nav_order: 99
|
||||
has_children: true
|
||||
redirect_from:
|
||||
- /opensearch/rest-api/
|
||||
---
|
||||
|
||||
# REST API reference
|
||||
|
|
|
@ -3,7 +3,9 @@ layout: default
|
|||
title: Asynchronous search
|
||||
nav_order: 51
|
||||
has_children: true
|
||||
redirect_from: /docs/async/
|
||||
redirect_from:
|
||||
- /docs/async/
|
||||
- /search-plugins/async/
|
||||
---
|
||||
|
||||
# Asynchronous search
|
||||
|
|
|
@ -25,7 +25,7 @@ If these roles don’t meet your needs, mix and match individual asynchronous se
|
|||
|
||||
Use backend roles to configure fine-grained access to asynchronous searches based on roles. For example, users of different departments in an organization can view asynchronous searches owned by their own department.
|
||||
|
||||
First, make sure your users have the appropriate [backend roles]({{site.url}}{{site.baseurl}}/security-plugin/access-control/). Backend roles usually come from an [LDAP server]({{site.url}}{{site.baseurl}}/security-plugin/configuration/ldap/) or [SAML provider]({{site.url}}{{site.baseurl}}/security-plugin/configuration/saml/). However, if you use the internal user database, you can use the REST API to [add them manually]({{site.url}}{{site.baseurl}}/security-plugin/access-control/api#create-user).
|
||||
First, make sure your users have the appropriate [backend roles]({{site.url}}{{site.baseurl}}/security-plugin/access-control/index/). Backend roles usually come from an [LDAP server]({{site.url}}{{site.baseurl}}/security-plugin/configuration/ldap/) or [SAML provider]({{site.url}}{{site.baseurl}}/security-plugin/configuration/saml/). However, if you use the internal user database, you can use the REST API to [add them manually]({{site.url}}{{site.baseurl}}/security-plugin/access-control/api#create-user).
|
||||
|
||||
Now when users view asynchronous search resources in OpenSearch Dashboards (or make REST API calls), they only see asynchronous searches submitted by users who have a subset of the backend role.
|
||||
For example, consider two users: `judy` and `elon`.
|
||||
|
|
|
@ -4,7 +4,9 @@ title: k-NN
|
|||
nav_order: 50
|
||||
has_children: true
|
||||
has_toc: false
|
||||
redirect_from: /docs/knn/
|
||||
redirect_from:
|
||||
- /docs/knn/
|
||||
- /search-plugins/knn/
|
||||
---
|
||||
|
||||
# k-NN
|
||||
|
|
|
@ -4,7 +4,9 @@ title: Piped processing language
|
|||
nav_order: 42
|
||||
has_children: true
|
||||
has_toc: false
|
||||
redirect_from: /docs/ppl/
|
||||
redirect_from:
|
||||
- /docs/ppl/
|
||||
- /search-plugins/ppl/
|
||||
---
|
||||
|
||||
# Piped Processing Language
|
||||
|
|
|
@ -4,7 +4,9 @@ title: SQL
|
|||
nav_order: 38
|
||||
has_children: true
|
||||
has_toc: false
|
||||
redirect_from: /docs/sql/
|
||||
redirect_from:
|
||||
- /docs/sql/
|
||||
- /search-plugins/sql/
|
||||
---
|
||||
|
||||
# SQL
|
||||
|
|
|
@ -4,12 +4,14 @@ title: Access Control
|
|||
nav_order: 10
|
||||
has_children: true
|
||||
has_toc: false
|
||||
redirect_from: /docs/security/access-control/
|
||||
redirect_from:
|
||||
- /docs/security/access-control/
|
||||
- /security-plugin/access-control/
|
||||
---
|
||||
|
||||
# Access control
|
||||
|
||||
After you [configure the security plugin]({{site.url}}{{site.baseurl}}/security-plugin/configuration/) to use your own certificates and preferred authentication backend, you can start adding users, creating roles, and mapping roles to users.
|
||||
After you [configure the security plugin]({{site.url}}{{site.baseurl}}/security-plugin/configuration/index/) to use your own certificates and preferred authentication backend, you can start adding users, creating roles, and mapping roles to users.
|
||||
|
||||
This section of the documentation covers what a user is allowed to see and do after successfully authenticating.
|
||||
|
||||
|
|
|
@ -4,7 +4,9 @@ title: Audit Logs
|
|||
nav_order: 90
|
||||
has_children: true
|
||||
has_toc: false
|
||||
redirect_from: /docs/security/audit-logs/
|
||||
redirect_from:
|
||||
- /docs/security/audit-logs/
|
||||
- /security-plugin/audit-logs/
|
||||
---
|
||||
|
||||
# Audit logs
|
||||
|
|
|
@ -4,19 +4,21 @@ title: Configuration
|
|||
nav_order: 5
|
||||
has_children: true
|
||||
has_toc: false
|
||||
redirect_from: /docs/security/configuration/
|
||||
redirect_from:
|
||||
- /docs/security/configuration/
|
||||
- /security-plugin/configuration/
|
||||
---
|
||||
|
||||
# Security configuration
|
||||
|
||||
The plugin includes demo certificates so that you can get up and running quickly, but before using OpenSearch in a production environment, you must configure it manually:
|
||||
|
||||
1. [Replace the demo certificates]({{site.url}}{{site.baseurl}}/opensearch/install/docker-security/)
|
||||
1. [Reconfigure opensearch.yml to use your certificates]({{site.url}}{{site.baseurl}}/security-plugin/configuration/tls/)
|
||||
1. [Replace the demo certificates]({{site.url}}{{site.baseurl}}/opensearch/install/docker-security)
|
||||
1. [Reconfigure opensearch.yml to use your certificates]({{site.url}}{{site.baseurl}}/security-plugin/configuration/tls)
|
||||
1. [Reconfigure config.yml to use your authentication backend]({{site.url}}{{site.baseurl}}/security-plugin/configuration/configuration/) (if you don't plan to use the internal user database)
|
||||
1. [Modify the configuration YAML files]({{site.url}}{{site.baseurl}}/security-plugin/configuration/yaml/)
|
||||
1. [Apply changes using securityadmin.sh]({{site.url}}{{site.baseurl}}/security-plugin/configuration/security-admin/)
|
||||
1. [Modify the configuration YAML files]({{site.url}}{{site.baseurl}}/security-plugin/configuration/yaml)
|
||||
1. [Apply changes using securityadmin.sh]({{site.url}}{{site.baseurl}}/security-plugin/configuration/security-admin)
|
||||
1. Start OpenSearch.
|
||||
1. [Add users, roles, role mappings, and tenants]({{site.url}}{{site.baseurl}}/security-plugin/access-control/)
|
||||
1. [Add users, roles, role mappings, and tenants]({{site.url}}{{site.baseurl}}/security-plugin/access-control/index/)
|
||||
|
||||
If you don't want to use the plugin, see [Disable security]({{site.url}}{{site.baseurl}}/security-plugin/configuration/disable/).
|
||||
If you don't want to use the plugin, see [Disable security]({{site.url}}{{site.baseurl}}/security-plugin/configuration/disable).
|
||||
|
|
|
@ -4,7 +4,9 @@ title: About the security plugin
|
|||
nav_order: 1
|
||||
has_children: false
|
||||
has_toc: false
|
||||
redirect_from: /docs/security/
|
||||
redirect_from:
|
||||
- /docs/security/
|
||||
- /security-plugin/
|
||||
---
|
||||
|
||||
# About the security plugin
|
||||
|
|
|
@ -3,6 +3,7 @@ layout: default
|
|||
title: Common issues
|
||||
nav_order: 1
|
||||
has_toc: false
|
||||
redirect_from: /troubleshoot/
|
||||
---
|
||||
|
||||
# Common issues
|
||||
|
|
Loading…
Reference in New Issue