gravitational / teleport

The easiest, and most secure way to access and protect all of your infrastructure.
https://goteleport.com
GNU Affero General Public License v3.0
17.5k stars 1.75k forks source link

Add MongoDB (or something else like Apache Cassandra) Support for Auditlog Events #3395

Closed janknieling closed 1 year ago

janknieling commented 4 years ago

Can you please add support for MongoDB or something else like Apache Cassandra or Redis to store the Audit Log Events in on Premise HA Cluster deployments? I think this will be very useful and a good alternative to the file storage in a directory.

I think for the Recored Sessions aren't any changes needed because there are enough OpenSource S3 compatible alternatives like OpenStack Swift or min.io (https://github.com/minio/minio)

webvictim commented 4 years ago

We support etcd which seems very similar to what you’re requesting - could you use that? There’s also a PR currently open for services which present a DynamoDB-like interface.

janknieling commented 4 years ago

Regarding to your documentation etcd is only supported for the Cluster State.

For the Cluster State we will use etcd and for the Recorded Sessions S3/ OpenStack Swift via S3 API.

But we want to use MongoDB (or Apache Cassandra) for the Audit Log events (or some other Open Source NoSQL database; I think MongoDB (or Apache Cassandra) is the best solution because it is a document-oriented database which uses JSON like documents with schema(BSON)).

I have seen this PR. The problem is, that these applications aren't stable . The ScyllaDB API for DynamoDB is in very experimental state. They don't recommend it for production use.

See README.md here https://github.com/scylladb/scylla/blob/master/README.md

There is also experimental support for the API of Amazon DynamoDB, but being experimental it needs to be explicitly enabled to be used. For more information on how to enable the experimental DynamoDB compatibility in Scylla, and the current limitations of this feature, see Alternator and Getting started with Alternator.

And Alternator.md here https://github.com/scylladb/scylla/blob/master/docs/alternator/alternator.md

For reasons explained above, the data model used by Alternator to store data on disk is still in a state of flux, and may change in future versions. Therefore, in this early stage it is not recommended to store important production data using Alternator.

In my opinion it will be very useful if there is an alternative OpenSource storage backend for Audit Log Events like MongoDB and not a service like ScyllaDB which implements a propretary API from Amazon

janknieling commented 4 years ago

Any updates here?

Kazyini commented 2 years ago

Any news in 2022?

zmb3 commented 1 year ago

Closing in favor of #12169 which has a bit more detail.