Basic user auth

[Poohowy]

Does anyone know a way to authenticate user created with Search Guard (or X-Pack, whatever)?

I have 3-node elasticsearch cluster. I installed elastizabbix and try to connect to ES cluster. But the problem is that elastizabbix does not have permission to get cluster stats or health. The problem is here:

stats = {
    'cluster': 'http://localhost:9200/_cluster/stats',
    'nodes'  : 'http://localhost:9200/_nodes/stats',
    'indices': 'http://localhost:9200/_stats',
    'health' : 'http://localhost:9200/_cluster/health'
}

I tried something like that:

stats = {
    'cluster': 'http://user:password@localhost:9200/_cluster/stats',
    'nodes'  : 'http://user:password@localhost:9200/_nodes/stats',
    'indices': 'http://user:password@localhost:9200/_stats',
    'health' : 'http://user:password@localhost:9200/_cluster/health'
}

But it does not work. Is there any way to walk around this issue?

[kirkwor]

@Poohowy

EDIT: I just noticed that I was on an older version of the agent "elastizabbix" file, so for the new version, scroll at the bottom for fix.

You can add these lines if you're still interested in auth:

- at the top

import base64

- before stats

username = 'your_user'
password = 'your_pass'

- the get_cache old entry

    if should_update and created_file(lock):
        with open(cache, 'w') as f: f.write(urllib2.urlopen(stats[api]).read())
        os.remove(lock)

- replace with get_cache new entry

    if should_update and created_file(lock):
        try:
            with open(cache, 'w') as f: f.write(urllib2.urlopen(stats[api]).read())
        except urllib2.HTTPError, e:
            if e.code == 401:
                auth = urllib2.Request(stats[api])
                base64string = base64.b64encode('%s:%s' % (username, password))
                auth.add_header("Authorization", "Basic %s" % base64string)
                with open(cache, 'w') as f: f.write(urllib2.urlopen(auth).read())
        os.remove(lock)

The get_cache def is now verifying if login is required; it does 1 check and if it fails with "HTTP Error 401: Unauthorized", then it will add the http header with the username/password that you've defined at the top and retry the connection, which should be successful.

If you want to do auth all the time then you can use it as:

    if should_update and created_file(lock):
        auth = urllib2.Request(stats[api])
        base64string = base64.b64encode('%s:%s' % (username, password))
        auth.add_header("Authorization", "Basic %s" % base64string)
        with open(cache, 'w') as f: f.write(urllib2.urlopen(auth).read())
        os.remove(lock)

URL call will always add the http header. The last setup with always sending auth info, avoids sending two calls to the server, probably it can be written better but this does the trick for me.

This works for the new version after "a4a685a" commit:

- at the top

import base64

- before stats

username = 'your_user'
password = 'your_pass'

- the get_cache old entry

    if should_update and created_file(lock):
        try:
            d = urllib2.urlopen(stats[api]).read()
            with open(cache, 'w') as f: f.write(d)
        except Exception as e:
            pass        
        if os.path.exists(lock):
            os.remove(lock)

- replace with get_cache new entry

    if should_update and created_file(lock):
        try:
            d = urllib2.urlopen(stats[api]).read()
            with open(cache, 'w') as f: f.write(d)
        except Exception as e:
            if e.code == 401:
                auth = urllib2.Request(stats[api])
                base64string = base64.b64encode('%s:%s' % (username, password))
                auth.add_header("Authorization", "Basic %s" % base64string)
                d = urllib2.urlopen(auth).read()
                with open(cache, 'w') as f: f.write(d)
            pass        
        if os.path.exists(lock):
            os.remove(lock)

and for auth all the time then you can use it as:

    if should_update and created_file(lock):
        try:
            auth = urllib2.Request(stats[api])
            base64string = base64.b64encode('%s:%s' % (username, password))
            auth.add_header("Authorization", "Basic %s" % base64string)
            d = urllib2.urlopen(auth).read()
            with open(cache, 'w') as f: f.write(d)
        except Exception as e:
            pass
        if os.path.exists(lock):
            os.remove(lock)