{"action":"opened","issue":{"url":"https://api.github.com/repos/Graylog2/collector-sidecar/issues/261","repository_url":"https://api.github.com/repos/Graylog2/collector-sidecar","labels_url":"https://api.github.com/repos/Graylog2/collector-sidecar/issues/261/labels{/name}","comments_url":"https://api.github.com/repos/Graylog2/collector-sidecar/issues/261/comments","events_url":"https://api.github.com/repos/Graylog2/collector-sidecar/issues/261/events","html_url":"https://github.com/Graylog2/collector-sidecar/issues/261","id":339899073,"node_id":"MDU6SXNzdWUzMzk4OTkwNzM=","number":261,"title":"Implement configurable collector binary whitelist","user":{"login":"bernd","id":461,"node_id":"MDQ6VXNlcjQ2MQ==","avatar_url":"https://avatars2.githubusercontent.com/u/461?v=4","gravatar_id":"","url":"https://api.github.com/users/bernd","html_url":"https://github.com/bernd","followers_url":"https://api.github.com/users/bernd/followers","following_url":"https://api.github.com/users/bernd/following{/other_user}","gists_url":"https://api.github.com/users/bernd/gists{/gist_id}","starred_url":"https://api.github.com/users/bernd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bernd/subscriptions","organizations_url":"https://api.github.com/users/bernd/orgs","repos_url":"https://api.github.com/users/bernd/repos","events_url":"https://api.github.com/users/bernd/events{/privacy}","received_events_url":"https://api.github.com/users/bernd/received_events","type":"User","site_admin":false},"labels":[{"id":445410255,"node_id":"MDU6TGFiZWw0NDU0MTAyNTU=","url":"https://api.github.com/repos/Graylog2/collector-sidecar/labels/blocker","name":"blocker","color":"e11d21","default":false},{"id":289425580,"node_id":"MDU6TGFiZWwyODk0MjU1ODA=","url":"https://api.github.com/repos/Graylog2/collector-sidecar/labels/enhancement","name":"enhancement","color":"84b6eb","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/Graylog2/collector-sidecar/milestones/3","html_url":"https://github.com/Graylog2/collector-sidecar/milestone/3","labels_url":"https://api.github.com/repos/Graylog2/collector-sidecar/milestones/3/labels","id":2028493,"node_id":"MDk6TWlsZXN0b25lMjAyODQ5Mw==","number":3,"title":"3.0.0","description":"Next major release of Graylog.","creator":{"login":"kroepke","id":52014,"node_id":"MDQ6VXNlcjUyMDE0","avatar_url":"https://avatars1.githubusercontent.com/u/52014?v=4","gravatar_id":"","url":"https://api.github.com/users/kroepke","html_url":"https://github.com/kroepke","followers_url":"https://api.github.com/users/kroepke/followers","following_url":"https://api.github.com/users/kroepke/following{/other_user}","gists_url":"https://api.github.com/users/kroepke/gists{/gist_id}","starred_url":"https://api.github.com/users/kroepke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kroepke/subscriptions","organizations_url":"https://api.github.com/users/kroepke/orgs","repos_url":"https://api.github.com/users/kroepke/repos","events_url":"https://api.github.com/users/kroepke/events{/privacy}","received_events_url":"https://api.github.com/users/kroepke/received_events","type":"User","site_admin":false},"open_issues":19,"closed_issues":19,"state":"open","created_at":"2016-09-26T10:54:30Z","updated_at":"2018-07-10T15:39:45Z","due_on":null,"closed_at":null},"comments":0,"created_at":"2018-07-10T15:39:44Z","updated_at":"2018-07-10T15:39:44Z","closed_at":null,"author_association":"MEMBER","body":"### Problem description\r\n\r\nWith the new sidecar implementation, the graylog server defines the paths to the collector backend binaries that will be started on a sidecar node. This can become a security problem when the central graylog server has been compromised by an attacker.\r\n\r\nTo mitigate this, the sidecar should have a configurable whitelist of binaries that are allowed to be executed on a sidecar node. That way an attacker cannot just configure a sidecar to execute arbitrary commands or scripts.\r\n\r\nExample `sidecar.yml` snippet:\r\n\r\n```yaml\r\ncollector_binaries_whitelist:\r\n  - \"/usr/lib/graylog-sidecar/filebeat\"\r\n  - \"/usr/bin/filebeat\"\r\n  - \"/usr/bin/packetbeat\"\r\n  - \"/usr/bin/nxlog\"\r\n  - \"C:\\\\Program Files\\\\Sysmon\\\\Sysmon64.exe\"\r\n```\r\nThe default configuration should ship with a pre-defined whitelist of common collectors like nxlog, filebeat, winlogbeat, sysmon, etc."}}
{"actor":{"display_login":"bernd"}}