At Kumina, we make heavy use of the ELK stack: Elasticsearch, Logstash and Kibana. All of our servers have their logs collected by Logstash and stored in Elasticsearch, so we can easily access them through Kibana. As of recently we started providing direct access to our Kibana instance to our customers, so that they can perform analysis on the data themselves. This brings us to an interesting problem: Elasticsearch – and in effect Kibana – does not implement any authentication and authorization mechanisms. This means that by default customers would be able to view each other’s data.
Support for access controls is instead offered by a commercial product by Elastic, called Shield. Though Shield certainly looks like an interesting product, it looks far too advanced and costly for the problem we tried to solve at Kumina: simply having partitioned access to the data for several customers. This is why we commissioned the development of a new piece of software called Buckler. Buckler is a light-weight proxy for Kibana, written in Python (Django). It allows you to restrict access in Kibana by adding password authentication. When logged in, a user is only allowed to access indices specified for that user in Buckler’s configuration file.
Free alternative to Shield
Today we’re glad to announce that we’re releasing Buckler as open source software licensed under the Apache License, version 2.0. The Git repository containing sources and documentation can be found on our company’s Git Hub page. In addition to the proxy itself, we’re also releasing a Vagrant environment that allows you to easily test and experiment with Buckler. Right now Buckler only works in combination with Kibana 4.1, as that’ s the version in use at Kumina. There is a fair chance we’re going to extend Buckler over time to support newer versions of Kibana, such as 4.3 and 5.x.
Enjoy!
Tags: authentication, authorization, buckler, elasticsearch, ELK stack, free, free software, git, gitlab, kibana, kumina, logstash, open source, password authentication, python, security, shield, software
Hi,
I am looking for open-source solutions to secure Elasticsearch & Kibana.
Can you please let me know if Buckler is compatible with version 5.6 and above of Elastic Stack.
Regards,
Sudeep Shekhar Mishra
Hello Sudeep,
Unfortunately, Buckler only works in combination with Kibana 4.1. For newer versions of Elasticsearch and Kibana, we advise you to use Elasticsearch’s own security framework (previously named Shield).