SpecterOps
Support for TLS Neo4j URI Schemes
Feature Description:
Support for TLS on Neo4j/Bolt Connections.
Current Behavior:
Currently Bloodhound only supports the unsecured Neo4j/Bolt URI schemes (neo4j://). As a result its not possible to connect to a Neo4j database that has TLS enabled.
If a scheme of neo4j+ssc:// or neo4j+s:// is specified, the application currently errors out. "Failed starting the server: failed to connect to databases: expected connection URL scheme neo4j for Neo4J but got neo4j+ssc"
Desired Behavior:
Using the .env file, or the docker-compose config, the option to set alternate URI schemes on the variable "bhe_neo4j_connection" would be nice. For example, as neo4j+s:// or neo4j+ssc://
Use Case:
While the general use case is for the Bloodhound, PostgreSQL and Neo4j to be bundled together with Docker, in the event that a separate Neo4j database is used, that has TLS enabled, there is no option to have it configured for this different URI schemes.
Implementation Suggestions:
The driver used does seem to support these URI schemes https://github.com/neo4j/neo4j-go-driver/ So likely that the issue is how "bhe_neo4j_connection" get passed to the driver.
Additional Information:
- Configuring TLS on Neo4j: https://neo4j.com/docs/operations-manual/current/security/ssl-framework/
- Neo4j URI Schemes: https://neo4j.com/docs/upgrade-migration-guide/current/version-4/migration/drivers/new-uri-schemes/
