Securing crate admin interface with userid and password about crate HOT 8 CLOSED

No, there is no option to secure the Crate admin interface with login credentials.
You could use traditional ways like firewalls, VPN, etc. to secure it.

The main reason why we do not support that is rather simple. One could still use our command-line tool crash (https://pypi.python.org/pypi/crash) and gain access to all the data.

Is there a specific use case you are looking into?

from crate.

okay,thanks for the clarification.I just thought about general security.For example if there are 2 applications using 2 different objects in crate, then may be the object specific to each application should only be visible/accessible to that application. So may be for such scenario, we may need different users/accounts along with credentials for each application to login and access respective objects.

from crate.

@ksasi: Maybe my blog post gives you some insights of solving a such problems.

from crate.

@ksasi ACLs are on our roadmap, but not implemented right now. so actually this kind of security has to be done on the application level right now. application level security is a common scenario for server-side applications like a web-service, where in most cases users only exist as normal database objects and the "real" database credentials are only used for securing the database connection itself - securing crate can be done via common http proxies or network level solutions such as iptables if needed.

however if you have a rich client application accessing crate via sql directly from each client, then this is not sufficient. it would be nice to have more insight on your use-case in order to refine our roadmap. thanks in advance, bernd

from crate.

How about Shield support with ES 1.4.2? Granted, this only helps those willing to pay for it. Just wondering if this will be supported naturally when Crate reaches that version.

from crate.

I created some security stuff for elasticsearch, maybe i can help:
https://github.com/salyh/elasticsearch-security-plugin
https://github.com/salyh/elastic-defender

from crate.

@dobe maybe you can try it during Snowsprint Hackathon? Regards to the other Snowsprinters ...

from crate.

CrateDB 2.3.0 (currently testing, https://crate.io/docs/crate/reference/en/latest/appendices/release-notes/2.3.0.html) added support for username/password authentication over HTTP protocol - which is used by the Admin UI.
You can find information how to secure the Admin UI in the "Authentication" docs https://crate.io/docs/crate/reference/en/latest/admin/auth/hba.html#authenticating-to-admin-ui and https://crate.io/docs/crate/reference/en/latest/admin/auth/index.html
User Authentication is an Enterprise feature.

from crate.