From d238621bfb86a68dbf4a9ecc0baffbfa9f117c3e Mon Sep 17 00:00:00 2001 From: John Floren Date: Mon, 17 Jun 2024 14:38:55 -0700 Subject: [PATCH 01/29] Document the updates to the account unlock tool Not to be merged before 5.5.0 release. --- tools/tools.md | 46 ++++++++++++++++++++++++++++++++++------------ 1 file changed, 34 insertions(+), 12 deletions(-) diff --git a/tools/tools.md b/tools/tools.md index 8d2e7839..3947354e 100644 --- a/tools/tools.md +++ b/tools/tools.md @@ -157,28 +157,50 @@ The Splunk migration tool is [fully documented here](/migrate/migrate). ## Account Unlock -The Account Unlock tool can be used to unlock and reset the password for any account. While an Admin user can perform this same functionality via the User Administration screens in the GUI, or via the Gravwell CLI, there may be times when you do not have a secondary Admin user who can make the changes for you. This tool provides a Break Glass ability for you to reset the password on an account or system when you do not have another way to do so. +The account unlock tool is a last-resort method for unlocking accounts, resetting passwords, or clearing MFA configurations. While an admin user can perform these same functions via the User Administration screens in the UI or via the Gravwell CLI, if the *admin's* account is the one in trouble, this tool can fix it. -You can find the tool at [https://update.gravwell.io/files/tools/accountUnlock.](https://update.gravwell.io/files/tools/accountUnlock) +The account unlock tool is included in the installers for the core Gravwell system (webserver/indexer/searchagent) and for the datastore. It will be installed to `/opt/gravwell/bin/account_unlock`. -MD5: f299262fddf05d067a8b60e975bfb72a +```{warning} +Before using the account unlock tool, you *must* shut down the Gravwell webserver! The webserver maintains a lock on the user database, so the tool cannot make any changes while the webserver is running. +``` + +The tool takes the following options: + +* `-clear-mfa`: Clear MFA configuration, potentially forcing user to re-configure on next login +* `-lock`: If set, specified accounts will be locked rather than unlocked +* `-reset-password `: If set, user password will be reset to this value +* `-override-userdb-path `: Override the path to the webstore file + +By default, the tool will always unlock any specified accounts, as well as performing additional actions (clearing MFA or resetting password) specified by the flags. If the `-lock` flag is used, the specified accounts will be *locked* rather than unlocked, in addition to any other actions specified. -SHA256: 0583805315f5420ce14aada8d3a63fa6638aad8fcf251989a5f819ad8709d0a9 +To unlock the admin account and reset its password: + +``` +sudo systemctl stop gravwell_webserver +sudo /opt/gravwell/bin/account_unlock -reset-password changeme admin +sudo systemctl restart gravwell_webserver +``` -To use the tool: -1. Download the tool on your system and make it executable -2. Stop the gravwell webserver (it has a lock on the user database) -3. As the root user (or user gravwell) run the accountUnlock tool with the account you want to reset as the argument -4. Restart the gravwell webserver +To reset a user's MFA configuration and lock the account: ``` sudo systemctl stop gravwell_webserver -sudo /tmp/accountUnlock admin +sudo /opt/gravwell/bin/account_unlock -clear-mfa -lock jsmith sudo systemctl restart gravwell_webserver -sudo systemctl status gravwell_webserver ``` -The tool will return with confirmation that the user account has been unlocked and the default password to which it has been reset. +### Account Unlock with Distributed Webservers + +When you have [distributed webservers](/distributed/frontend), you cannot run the account unlock tool on the webserver, because any changes will be overwritten immediately from the datastore component, which is considered the source of truth for user accounts. Instead, run the command *on the datastore system*, being sure to stop the datastore process itself first: + +``` +sudo systemctl stop gravwell_datastore +sudo /opt/gravwell/bin/account_unlock -reset-password changeme admin +sudo systemctl start gravwell_datastore +``` + +The changes should be rapidly propagated to the webservers from the datastore. ## Export From 0abaef666387d96764a5dff2a429c04befdaff6b Mon Sep 17 00:00:00 2001 From: John Floren <108435989+john-floren-gravwell@users.noreply.github.com> Date: Wed, 10 Jul 2024 12:35:25 -0700 Subject: [PATCH 02/29] Update tools/tools.md Co-authored-by: Ashley Wade <107071905+ashnwade@users.noreply.github.com> --- tools/tools.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/tools.md b/tools/tools.md index 3947354e..d5e0a21e 100644 --- a/tools/tools.md +++ b/tools/tools.md @@ -192,7 +192,7 @@ sudo systemctl restart gravwell_webserver ### Account Unlock with Distributed Webservers -When you have [distributed webservers](/distributed/frontend), you cannot run the account unlock tool on the webserver, because any changes will be overwritten immediately from the datastore component, which is considered the source of truth for user accounts. Instead, run the command *on the datastore system*, being sure to stop the datastore process itself first: +When you have [distributed webservers](/distributed/frontend), you cannot run the account unlock tool on the webserver because any changes will be overwritten immediately from the datastore component, which is considered the source of truth for user accounts. Instead, run the command *on the datastore system*, being sure to stop the datastore process itself first: ``` sudo systemctl stop gravwell_datastore From ca092858a36efb75d0aa64343b368c5670300c20 Mon Sep 17 00:00:00 2001 From: ashnwade Date: Wed, 10 Jul 2024 15:42:34 -0400 Subject: [PATCH 03/29] pretty functions with duplicate removed --- search/eval/eval.md | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/search/eval/eval.md b/search/eval/eval.md index 57abfac3..79d22348 100644 --- a/search/eval/eval.md +++ b/search/eval/eval.md @@ -436,6 +436,30 @@ Returns the input with all leading and trailing whitespace removed. Returns the input with the trailing suffix removed. +#### pretty_size + + function pretty_size(input string) string + +Converts a number to an abreviated pretty printed size, 1234567 becomes "1.18 MB". + +#### pretty_count + + function pretty_count(input string) string + +Converts a number to an abreviated pretty printed magnitude, 1234567 becomes "1.24 M". + +#### pretty_rate + + function pretty_rate(number, duration) string + +Converts a number to an abreviated pretty printed rate in bytes, kilobytes, or megabytes per second given a magnitude and duration; "pretty_rate(1234567, "2s")" becomes "588.87 KB/s". + +#### pretty_line_rate + + function pretty_line_rate(number, duration) string + +Converts a number to an abreviated pretty printed line rate in bits, kilobits, and megabits per second given a magnitude and duration; "pretty_line_rate(1234567, "2s")" becomes "4.71 Mb/s". + ### Hash #### hash_md5 From d78a73d1ee4afcc493de81c2807243c3ddc713b6 Mon Sep 17 00:00:00 2001 From: David Fritz Date: Fri, 12 Jul 2024 10:09:11 -0600 Subject: [PATCH 04/29] Add top/bottom docs. Fixes #998 --- search/processingmodules.md | 2 + search/topbottom/topbottom.md | 77 +++++++++++++++++++++++++++++++++++ 2 files changed, 79 insertions(+) create mode 100644 search/topbottom/topbottom.md diff --git a/search/processingmodules.md b/search/processingmodules.md index c0ef9058..201d9b36 100644 --- a/search/processingmodules.md +++ b/search/processingmodules.md @@ -78,6 +78,7 @@ strings subnet taint time