Add a section about Securing Graylog about documentation

[joschi]

@mikkolehtisalo Thanks, that's a very good idea!

[jalogisch]

@mikkolehtisalo first part should be covered with 7e997f4 what is your opinion on this?

[mikkolehtisalo]

@jalogisch Some good things there! In any case, many companies and such raise the questions "is X secure", and "how to harden X to achieve compliance Y" as a separate step in the process of approving systems for use. Being able to find and verify all necessary (sometimes even small) details is important.

Also, my thinking is that the documentation is growing. It needs more structure, or it becomes messy. (Mostly separating basic installation from extra configuration, which can vary greatly, but this also goes for some security topics that are strictly not mandatory...)

[jalogisch]

@mikkolehtisalo i see your points. i personal had started to restructure the documentation a little with this #96

Divide between simple and complex setups is not that easy as we would need to rewrite most parts of the documentation and change the logical structure. But we could add some points to the documentation to have them available.

My idea would be to add:

• how to setup and use mongo in HA (in short what needs to be done within mongo and what needs to be configured on graylog)
• how a possible HA setup can look and how this can be secured best by design

But it looks like you @mikkolehtisalo had some insides, what would needed from someone that has not knowledge about the moving parts and how to setup. Can you please suggest in detail what would be needed to fulfill the needs of someone who is looking from a non technical point into the documentation to archive compliance.
If you give us some hints what is needed we can add this step by step to the configuration.

[aoyawale]

just wanted to share this for apache and nginx TLS config using stronger ciphers https://mozilla.github.io/server-side-tls/ssl-config-generator/

[jalogisch]

We could never cover a complete security guide as all setups are different and have different needs. In addition MongoDB and Elasticsearch are on a second page - where the later has some fundamental questions to answer before you can decide about the security (OSS Elasticsearch VS Enterprise Elasticsearch).

Will close this and we will/have already in mind to include more information how to secure something PLUS the product will improve in this section.