logstash_auditor 0.0.19 → 1.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 68fa2c1de9dfa4b889de3d57764a7e2bd9d0e8fd
-  data.tar.gz: 1542b81db046da2af7eea91ef50cfcae1a6449b3
+  metadata.gz: 3ed5b6819284fdb6fa9261a6fa3ff3bff44934a7
+  data.tar.gz: b1f6b5ddec3302de7d5a840a51c95ab451e8d340
 SHA512:
-  metadata.gz: 308263936322bb6f69ac5f8b48af74a6dfeee24cafb8a1635c8cfc8e8c399fcda9c9e0cc06e12a8716d50b7d348ddcce1c67de29624b6eac0acf0ce023482a42
-  data.tar.gz: b09ff37290b6103ac1ab43f527a659b0b1c3602d817e2ca5c1092684a22290db619882b9d910a25de9dae82012da2bbc60f6edacf0a5880a09f2e137320542f8
+  metadata.gz: cd8eb41de82e38b1c8b6e54dca071e70553acdf7a0c3ea78e45fd8f4b4c28bcc1432a20ffdb0421134c5daefcfb2cb728abcc7df7c4c9ba0481d3d80df89883a
+  data.tar.gz: a9f780c3e1b2502887b8873ddb7e0ebc33c7130b8f10443301a8b7971d91d03c9fbb2243927e52b71e1edd8322c7522597d0a5ec6ce4db6430bfe22f44e8f20f

data/.gitignore

@@ -47,3 +47,10 @@ build/
 
 # unless supporting rvm < 1.11.0 or doing something fancy, ignore this:
 .rvmrc
+
+/spec/support/certificates/**/*.pem
+/spec/support/certificates/**/*.pkcs12
+/spec/support/certificates/**/index*
+/spec/support/certificates/**/serial*
+/spec/support/certificates/**/crlnumber
+/spec/support/certificates/**/*.jks

data/README.md

@@ -1,6 +1,6 @@
 # LogstashAuditor
 
-This gem provides the logstash auditor that can be plugged into the SOAR architecture.
+This gem provides the logstash auditor that can be plugged into the SOAR architecture. The auditor supports basic and certifcate based authentication to the logstash http input.  Privacy can be ensured by simply using an tls tunnel.
 
 ## State of the API
 
@@ -25,14 +25,20 @@ Or install it yourself as:
 
 ## Configuration of Logstash Server
 
-The logstash server must be configured using the configuration in the folder spec/support/logstash_conf.d
+The logstash server must be configured using the configuration in the folder spec/support/logstash_conf.d and spec/support/certificates.
 This configuration is used by the docker image during the TDD tests which ensures that this gem and the server configuration is compatible.
 
 ## Testing
 
-Behavioural driven testing can be performed by testing against a local ELK docker image:
+Behavioural driven testing can be performed by testing against a local ELK docker image.
 
-    $ sudo docker run -d -v $(pwd)/spec/support/logstash_conf.d:/etc/logstash/conf.d -p 9300:9300 -p 9200:9200 -p 5000:5000 -p 5044:5044 -p 5601:5601 -p 8081:8080 sebp/elk
+First you need to generate the certificates needed for authenticating the client to the server and the server itself.
+
+    $ ./spec/support/certificates/setup_certificates_for_logstash_testing.sh
+
+Start a docker container with the ELK stack:
+
+    $ docker run -d --name elk_test_service -v $(pwd)/spec/support/logstash_conf.d:/etc/logstash/conf.d -v $(pwd)/spec/support/certificates:/etc/logstash/certs -p 9300:9300 -p 9200:9200 -p 5000:5000 -p 5044:5044 -p 5601:5601 -p 8081:8080 sebp/elk
 
 Wait about 30 seconds for image to fire up. Then perform the tests:
 
@@ -41,14 +47,14 @@ Wait about 30 seconds for image to fire up. Then perform the tests:
 Note that in order to ensure that the processing has occurred on Elastic Search
 there is a 2 second delay between each event submission request and the search request
 
-Afterwards destroy the running docker image as follows:
-    $ sudo docker ps
-    $ sudo docker stop <CONTAINER_ID>
-
 Debugging the docker image:
-    $ sudo docker exec -it <CONTAINER_ID> bash
-    $ sudo docker stop $(sudo docker ps -a -q)
-    $ sudo docker rm -f $(sudo docker ps -a -q)
+    $ docker exec -it elk_test_service bash
+    $ docker stop elk_test_service
+    $ docker rm -f elk_test_service
+
+Manual sending of an audit event to docker ELK stack:
+
+    $ curl -iv -E ./spec/support/certificates/selfsigned/selfsigned_registered.cert.pem --key ./spec/support/certificates/selfsigned/selfsigned_registered.private.nopass.pem https://localhost:8081 -d "message=soar_logstash_test" --insecure
 
 ## Usage
 

data/lib/logstash_auditor/auditor.rb

@@ -6,36 +6,58 @@ module LogstashAuditor
 
     #inversion of control method required by the AuditorAPI
     def configuration_is_valid?(configuration)
-      required_parameters = ["host_url", "username", "password"]
-      required_parameters.each { |parameter| return false unless configuration.include?(parameter) }
-      return true
+      basic_auth_configuration_valid?(configuration) or
+      certificate_auth_configuration_valid?(configuration)
     end
 
     #inversion of control method required by the AuditorAPI
     def audit(audit_data)
       request = create_request(audit_data)
-      http    = create_http_transport
+      http = create_http_transport
       send_request_to_server(http, request)
     end
 
     private
 
+    def basic_auth_configuration_valid?(configuration)
+      required_parameters = ['host_url', 'username', 'password']
+      required_parameters.each { |parameter| return false unless configuration.include?(parameter) }
+      return true
+    end
+
+    def certificate_auth_configuration_valid?(configuration)
+      required_parameters = ['host_url', 'public_key', 'private_key']
+      required_parameters.each { |parameter| return false unless configuration.include?(parameter) }
+      return true
+    end
+
     def create_http_transport
-      uri = URI.parse(@configuration["host_url"])
+      uri = URI.parse(@configuration['host_url'])
       http = Net::HTTP.new(uri.host, uri.port)
       http.use_ssl = true if uri.is_a?(URI::HTTPS)
-      http.read_timeout = @configuration["timeout"]
-      http.open_timeout = @configuration["timeout"]
+      http.read_timeout = @configuration['timeout']
+      http.open_timeout = @configuration['timeout']
+      add_certificate_authentication(http) if certificate_auth_configuration_valid?(@configuration)
       return http
     end
 
+    def add_certificate_authentication(http)
+      http.cert = OpenSSL::X509::Certificate.new(@configuration['public_key'])
+      http.key = OpenSSL::PKey::RSA.new(@configuration['private_key'])
+      http.verify_mode = OpenSSL::SSL::VERIFY_NONE
+    end
+
     def create_request(audit_data)
       request = Net::HTTP::Post.new("/", initheader = {'Content-Type' => 'text/plain'})
-      request.basic_auth(@configuration["username"], @configuration["password"])
+      add_basic_auth(request) if @configuration['username'] and @configuration['password']
       request.body = audit_data
       return request
     end
 
+    def add_basic_auth(request)
+      request.basic_auth(@configuration['username'], @configuration['password'])
+    end
+
     def send_request_to_server(http, request)
       response = http.request(request) rescue nil
       raise StandardError, 'Failed to create connection' if response.nil?

data/lib/logstash_auditor/version.rb

@@ -1,3 +1,3 @@
 module LogstashAuditor
-  VERSION = "0.0.19"
+  VERSION = "1.0.0"
 end

data/sanity/Gemfile

@@ -1,4 +1,4 @@
 source 'https://rubygems.org'
 
-gem 'logstash_auditor', "~> 0.0.19"
+gem 'logstash_auditor', "~> 1.0.0"
 gem "soar_auditing_format", "~> 0.0.5"

data/sanity/sanity.rb

@@ -6,11 +6,10 @@ require 'securerandom'
 class Main
   def test_sanity
     @iut = LogstashAuditor::LogstashAuditor.new
-    @logstash_configuration =
-    { "host_url" => "http://localhost:8081",
-      "username" => "auditorusername",
-      "password" => "auditorpassword",
-      "timeout"  => 3}
+    @logstash_configuration = { "host_url"    => "https://localhost:8081",
+                                "public_key"  => File.read("../spec/support/certificates/selfsigned/selfsigned_registered.cert.pem"),
+                                "private_key" => File.read("../spec/support/certificates/selfsigned/selfsigned_registered.private.nopass.pem"),
+                                "timeout"     => 3}
     @iut.configure(@logstash_configuration)
     @iut.set_audit_level(:debug)
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: logstash_auditor
 version: !ruby/object:Gem::Version
-  version: 0.0.19
+  version: 1.0.0
 platform: ruby
 authors:
 - Barney de Villiers
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2016-07-01 00:00:00.000000000 Z
+date: 2016-08-31 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler