Secure your Elasticsearch Cluster
Tags: elasticsearch, security, devops, search
Published: 2020-12-02 07:13:55

> TL;DR - Basic Authentication, RBAC in Elasticsearch is free. You should enable it and protect your cluster from attacks, data breaches.

The cost of a data breach is huge to any organization. Be it a Bank, eCommerce Company, or an early-stage startup. 

It is a loss to your customers. There is an intangible loss of reputation. And then, the regulatory problems from the authorities.

Imagine you open your email one morning, that the data from your Elasticsearch cluster is deleted and you have to pay some money to the attacker to get the data. Sounds troublesome, isn't it?

## What security features are available as free?

More than a year ago, Elastic made their [core security features of the Elastic Stack are free](https://www.elastic.co/blog/security-for-elasticsearch-is-now-free). It means you can enable and leverage TLS encryption between nodes, role-based access control, basic authentication. 

You can leverage these features to protect the data sent via [Logstash](https://www.elastic.co/guide/en/logstash/current/ls-security.html) and data shippers like [Filebeat](https://www.elastic.co/guide/en/beats/filebeat/current/securing-communication-elasticsearch.html).

Sidenote: You can use the secure keystore's in [Filebeat](https://www.elastic.co/guide/en/beats/filebeat/current/keystore.html) and [Logstash](https://www.elastic.co/guide/en/logstash/current/keystore.html) to store sensitive settings. 

## How to check if my ES cluster is unprotected?

### Option 1: 

Usually, the ES cluster is bootstrapped to start on the port number `9200`. You can check whether if you could access, the cluster endpoint remotely using an API client like [postman](https://www.postman.com) or [hopscotch](https://hoppscotch.io) or as simple as chrome browser in incognito mode.

```
<endpoint_url>:9200
```

You should be getting the below message. 

```json
{
    "error": {
        "root_cause": [
            {
                "type": "security_exception",
                "reason": "action [cluster:monitor/main] requires authentication",
                "header": {
                    "WWW-Authenticate": [
                        "Basic realm=\"security\" charset=\"UTF-8\"",
                        "Bearer realm=\"security\"",
                        "ApiKey"
                    ]
                }
            }
        ],
        "type": "security_exception",
        "reason": "action [cluster:monitor/main] requires authentication",
        "header": {
            "WWW-Authenticate": [
                "Basic realm=\"security\" charset=\"UTF-8\"",
                "Bearer realm=\"security\"",
                "ApiKey"
            ]
        }
    },
    "status": 401
}
```
 

### Option 2: 

Starting Kibana 7.10, you will also see a popup in Kibana if your cluster isn't secure. 

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/2l9wqjzpi58nn76qo765.png)

## What more?

With Users and Roles, you can multiple users and assign them specific roles to limit their access to the cluster data. 

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/4qsm4joh44ss6ocjujr0.png)

You can create a Kibana space to limit access to users for a specific dashboard. 

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/1jsj0xuvt76fsnbz3395.png)



Thanks for reading it this far. If you have more questions on Elasticsearch security, please join the [community slack group](https://ela.st/slack) or ask a question on our [technical forum](https://discuss.elastic.co) or you could try spinning up a cluster using this [link](https://cloud.elastic.co).

Happy to help! 

--
Stay Safe
[Aravind Putrevu](https://twitter.com/intent/user?original_referer=https%3A%2F%2Faravind.dev%2F&ref_src=twsrc%5Etfw&region=follow&screen_name=aravindputrevu&tw_p=followbutton)