releasing 1.12.0

Author: sscarduzio

CHANGELOG.md

@@ -6,6 +6,13 @@
 ## Unreleased
 
 ## Released
+
+> 2016-11-02 ::new v1.12.0:
+* **security bugfix** IMPORTANT: prevent generic searches returning results for all indices
+* **bugfix**: rewritten index and kibana_access rules.
+* **testing**: more than 50 integration tests added
+* **enhancement**: more informative, colored logging in info mode
+
 > 2016-10-17 :new: v1.11.0:
 * **feature** Support for groups of users in ACL, thanks Christian Henke for the great PR!
 * **bugfix**  Make ```auth_key_sha1``` behave like ````auth_key``` rule: return 401 instead of 403 status code if Authorization header was required

README.md

@@ -17,7 +17,7 @@ List of other supported Elasticsearch versions: [releases](https://github.com/ss
 
 ```bash
 ES_VERSION=2.4.1
-bin/plugin install https://github.com/sscarduzio/elasticsearch-readonlyrest-plugin/releases/download/v1.10.0_es-v$ES_VERSION/elasticsearch-readonlyrest-v1.11.0_es-v$ES_VERSION.zip
+bin/plugin install https://github.com/sscarduzio/elasticsearch-readonlyrest-plugin/releases/download/v1.12.0_es-v$ES_VERSION/elasticsearch-readonlyrest-v1.11.0_es-v$ES_VERSION.zip
 ```
 
 ### 2. Configuration
@@ -60,35 +60,52 @@ readonlyrest:
 
 ### USE CASE 2: Multiuser Kibana + Authenticated Logstash (various permission levels)
 ```yml
-# remember to set the right CORS origin (or disable it, if you're brave). See https://github.com/elastic/kibana/issues/6719
-http.cors.enabled: true
-http.cors.allow-origin: /https?:\/\/localhost(:[0-9]+)?/
 
 readonlyrest:
     enable: true
-    
+    ssl:
+      enable: true
+      keystore_file: "/elasticsearch/plugins/readonlyrest/keystore.jks"
+      keystore_pass: readonlyrest
+      key_pass: readonlyrest
+
     response_if_req_forbidden: Forbidden by ReadonlyREST ES plugin
-    
+
     access_control_rules:
 
-    - name: "Logstash can write and create its own indices"
+    - name: "::LOGSTASH::"
       # auth_key is good for testing, but replace it with `auth_key_sha1`!
       auth_key: logstash:logstash
       type: allow
       actions: ["indices:data/read/*","indices:data/write/*","indices:admin/template/*","indices:admin/create"]
       indices: ["logstash-*", "<no-index>"]
 
-    - name: Kibana Server (we trust this server side component, full access granted via HTTP authentication)
+    # We trust this server side component, full access granted via HTTP authentication
+    - name: "::KIBANA-SRV::"
       # auth_key is good for testing, but replace it with `auth_key_sha1`!
-      auth_key: admin:passwd3
+      auth_key: kibana:kibana
       type: allow
 
-    - name: Developer (reads only logstash indices, but can create new charts/dashboards)
-      # auth_key is good for testing, but replace it with `auth_key_sha1`!
-      auth_key: dev:dev
+    # Logs in via HTTP Basic Authentication, has RW access to kibana but zero access to non-kibana actions.
+    - name: "::RO+ DEVELOPER::"
+      auth_key: ro+:dev
       type: allow
       kibana_access: ro+
-      indices: ["<no-index>", ".kibana*", "logstash*", "default"]
+      indices: ["<no-index>", ".kibana", ".kibana-devnull", "logstash-*", "default"]
+
+    # Cannot configure or edit dashboards and visualizations.
+    - name: "::RO DEVELOPER::"
+      auth_key: ro:dev
+      type: allow
+      kibana_access: ro
+      indices: ["<no-index>", ".kibana", ".kibana-devnull", "logstash-*", "default"]
+
+    # No authentication required to read from this index
+    - name: "::PUBLIC SEARCH::"
+      type: allow
+      indices: ["public"]
+      actions: ["indices:data/read/*"]
+
 
 ```
 **Now activate authentication in Kibana server**: let the Kibana daemon connect to ElasticSearch in privileged mode.

pom.xml

@@ -5,7 +5,7 @@
 	<modelVersion>4.0.0</modelVersion>
 	<groupId>org.elasticsearch</groupId>
 	<artifactId>readonlyrest</artifactId>
-	<version>1.12.0-rc2</version> <!-- plugin_version -->
+	<version>1.12.0</version> <!-- plugin_version -->
 	<packaging>jar</packaging>
 	<description>Safely expose Elasticsearch REST API directly to the public with access control list</description>
 	<inceptionYear>2013</inceptionYear>

src/main/resources/plugin-descriptor.properties

@@ -1,6 +1,6 @@
 name=readonlyrest
 description=${project.description}
-version=1.12.0-rc2
+version=1.12.0
 site=false
 jvm=true
 classname=org.elasticsearch.plugin.readonlyrest.ReadonlyRestPlugin

src/test/eshome/plugins/readonlyrest/plugin-descriptor.properties

@@ -1,6 +1,6 @@
 name=readonlyrest
 description=${project.description}
-version=1.12.0-rc2
+version=1.12.0
 site=false
 jvm=true
 classname=org.elasticsearch.plugin.readonlyrest.ReadonlyRestPlugin