Update for ElasticSearch authentication

nbs-system / naxsi

NAXSI is an open-source, high performance, low rules maintenance WAF for NGINX

GNU General Public License v3.0

4.8k stars 606 forks source link

Update for ElasticSearch authentication #407

Closed maxidea-com closed 2 years ago

maxidea-com commented 6 years ago

https://github.com/nbs-system/naxsi/issues/399

es = elasticsearch.Elasticsearch(cfg.cfg["elastic"]["host"],
http_auth=(cfg.cfg["elastic"]["user"],cfg.cfg["elastic"]["pass"]),
verify_certs=False,
use_ssl=use_ssl)

sabban commented 6 years ago

Hi, It's a great idea to use authentication against ES. But I am not confident with providing security software that doesn't check ssl certificates.

Can you provide a patch that could make it optional (check the validity by default, and if the option is provided, bypass the check) ?

And if I have the time I will update the "new tool" https://github.com/nbs-system/nxtool-ng/blob/master/nxtool/log_providers/elastic.py the exact same way.

Thanks.