<html><head></head><body>When planning to stand up a new Elasticsearch cluster, it is important to make considerations for implementing authentication and SSL/TLS with Shield as early as possible. Getting this going in the planning and testing phases will help ensure a smoother transition to production with security in place.
In this article, we walk through setting up Shield&apos;s native authentication and SSL/TLS with a wildcard certificate. Native authentication is by far the simplest way to manage users and it will be the default in X-Pack for Elasticsearch 5.x.&#xA0;
There are many ways to setup SSL/TLS, and in this post we will go through one of them that I find simple and easy to use for all my development environments. Prior to proceeding, be sure you have a certificate authority (CA) in place. A private (self-signed) or public CA can be used.
<h1>Getting Started</h1>1. <a href="https://www.elastic.co/guide/en/elasticsearch/reference/2.3/_installation.html">Install Elasticsearch</a>
2. Install the License and Shield plugins

<pre class="prettyprint">bin/plugin install elasticsearch/license/latest
bin/plugin install elasticsearch/shield/latest
</pre>3. Configure <code>elasticsearch.yml</code> for Shield&apos;s file and native authentication. <a href="https://www.elastic.co/guide/en/shield/2.3/file-realm.html">File-based authentication</a> stores users and passwords in file stored locally on each cluster node. With <a href="https://www.elastic.co/guide/en/shield/2.3/native-realm.html">native authentication</a>, users are managed with a REST API and centrally stored in the cluster. In Elasticsearch 2.3.x, file-based authentication must be configured prior to using native authentication to gain access to the cluster. This step will not be required in 5.x.
<pre class="prettyprint">shield:
 authc:
 realms:
 file1:
 type: file
 order: 0
 native1:
 type: native
 order: 1
</pre>4. Create an admin user with the <code>esusers</code> command that will be used for file-based authentication.
<pre class="prettyprint">bin/shield/esusers useradd admin -p as@m25 -r admin
</pre>5. Test authentication to the cluster using a REST client. I like curl, but any REST client will do.
<pre class="prettyprint">curl -s &apos;http://node1.kle.moc:9200&apos; -u admin:as@m25
{
 &quot;name&quot; : &quot;roger&quot;,
 &quot;cluster_name&quot; : &quot;kermy&quot;,
 &quot;version&quot; : {
 &quot;number&quot; : &quot;2.3.4&quot;,
 &quot;build_hash&quot; : &quot;e455fd0c13dceca8dbbdbb1665d068ae55dabe3f&quot;,
 &quot;build_timestamp&quot; : &quot;2016-06-30T11:24:31Z&quot;,
 &quot;build_snapshot&quot; : false,
 &quot;lucene_version&quot; : &quot;5.5.0&quot;
 },
 &quot;tagline&quot; : &quot;You Know, for Search&quot;
}
</pre><h1>Native Authentication</h1>Use the Shield REST API to configure and manage users for native authentication. To setup the first native admin user, use the file-based credentials.
<pre class="prettyprint">curl -u admin:as@m25 &apos;http://node1.kle.moc:9200/_shield/user/esadmin&apos; -XPOST -d &apos;
{
 &quot;password&quot;: &quot;as@m25&quot;,
 &quot;roles&quot;: [ &quot;admin&quot; ],
 &quot;full_name&quot;: &quot;Search Admin&quot;,
 &quot;email&quot;: &quot;searchadmin@kle.moc&quot;
}&apos;
</pre>Confirm the native user was setup successfully with a REST call.
<pre class="prettyprint">curl &apos;http://node1.kle.moc:9200&apos; -u esadmin:as@m25
{
 &quot;name&quot; : &quot;roger&quot;,
 &quot;cluster_name&quot; : &quot;kermy&quot;,
 &quot;version&quot; : {
 &quot;number&quot; : &quot;2.3.4&quot;,
 &quot;build_hash&quot; : &quot;e455fd0c13dceca8dbbdbb1665d068ae55dabe3f&quot;,
 &quot;build_timestamp&quot; : &quot;2016-06-30T11:24:31Z&quot;,
 &quot;build_snapshot&quot; : false,
 &quot;lucene_version&quot; : &quot;5.5.0&quot;
 },
 &quot;tagline&quot; : &quot;You Know, for Search&quot;
}
</pre><h1>Configuring SSL/TLS</h1><h2>Create the Java Keystore</h2>In this example, a wildcard certificate will be used as it provides ease of administration across a large Elasticsearch cluster. Wildcards permit a single certificate to be used for every node in the cluster. While this is a convenient way to manage cluster certificates, be sure to take into consideration the risk factors associated with using wildcards.
It is assumed an issuing certificate authority (CA) is already in place. See the article <a href="https://www.elastic.co/guide/en/shield/2.3/certificate-authority.html">Setting Up a Certificate Authority</a> for help setting up your own CA that can be used with Shield.
1. Create a new Java Keystore by importing the CA certificate that will issue the wildcard certificate. Note: the Java Keystore can be created on any host or workstation with Java installed using the keytool command.
<pre class="prettyprint">keytool -importcert -keystore shield.jks -file ca.cert.pem -trustcacerts -storepass s3cret -alias ca_cert
</pre>2. Create a private key in the Java Keystore.
<pre class="prettyprint">keytool -storepass s3cret -genkey -alias es-shield -keystore shield.jks -keyalg RSA -keysize 2048 -validity 3650 -dname &quot;cn=*.kle.moc&quot;
</pre>3. Create a certificate signing request (CSR) using keytool for requesting a certificate from the issuing CA.
<pre class="prettyprint">keytool -storepass s3cret -certreq -alias es-shield -keystore shield.jks -keyalg RSA -keysize 2048 -validity 3650 -dname &quot;cn=*.kle.moc&quot; &gt; kermy-shield.csr
</pre>4. Once the CA has signed the CSR and returned the certificate in PEM format, import it into the Java Keystore. Be sure the alias lines up with the one used in steps 2 and 3.
<pre class="prettyprint">keytool -storepass s3cret -importcert -keystore shield.jks -alias es-shield -file kermy-shield.pem
Certificate reply was installed in keystore
</pre><h2>Configure Elasticsearch</h2>1. Copy <code>shield.jks</code> to the Elasticsearch configuration directory <code>{path.conf}/shield</code>.
2. Configure elasticsearch.yml for SSL/TLS
<pre class="prettyprint">shield:
 http.ssl: true
 ssl:
 keystore.path: shield/shield.jks
 keystore.password: s3cret
</pre>My full <code>elasticsearch.yml</code>
<pre class="prettyprint">cluster.name: kermy
node.name: roger
network.host: _ens160:ipv4_
http.port: 9200
transport.tcp.port: 9300
shield:
 http.ssl: true
 ssl:
 keystore.path: shield/shield.jks
 keystore.password: s3cret
 authc:
 realms:
 file1:
 type: file
 order: 0
 native1:
 type: native
 order: 1
</pre>And the final curl test with SSL/TLS and native authentication
<pre class="prettyprint">curl &apos;https://node1.kle.moc:9200/&apos; -sku esadmin:as@m25 -v
* Trying 192.168.5.50...
* Connected to node1.kle.moc (192.168.5.50) port 9201 (#0)
* TLS 1.2 connection using TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
* Server certificate: *.kle.moc
* Server certificate: Unicorn Ltd CA
* Server auth using Basic with user &apos;esadmin&apos;
&gt; GET / HTTP/1.1&gt; Host: node1.kle.moc:9200
&gt; Authorization: Basic ZXNhZG1pbjphc0BtMjU=
&gt; User-Agent: curl/7.43.0
&gt; Accept: */*
&gt;
&lt; HTTP/1.1 200 OK
&lt; Content-Type: application/json; charset=UTF-8
&lt; Content-Length: 306
&lt;
{
 &quot;name&quot; : &quot;roger&quot;,
 &quot;cluster_name&quot; : &quot;kermy&quot;,
 &quot;version&quot; : {
 &quot;number&quot; : &quot;2.3.4&quot;,
 &quot;build_hash&quot; : &quot;e455fd0c13dceca8dbbdbb1665d068ae55dabe3f&quot;,
 &quot;build_timestamp&quot; : &quot;2016-06-30T11:24:31Z&quot;,
 &quot;build_snapshot&quot; : false,
 &quot;lucene_version&quot; : &quot;5.5.0&quot;
 },
 &quot;tagline&quot; : &quot;You Know, for Search&quot;
}
* Connection #0 to host node1.kle.moc left intact
</pre>Enabling SSL/TLS and authentication should be at the forefront of every service running in your infrastructure, including Elasticsearch. Once this configuration is in place, it can be modeled for further production use when adding new nodes or creating more clusters.&#xA0;
We want to help you ensure that your Elasticsearch cluster is safe and secure. <a href="https://www.elastic.co/downloads/shield">Give Shield, security for Elasticsearch, a try</a> and we welcome your feedback via the <a href="https://discuss.elastic.co/c/shield">forums</a> or file a support ticket.
</body></html>

elastic-security-authentication-full-bleed.jpg

elasticsearch-ssl-native-authentication.jpg

Getting Started with Elasticsearch and SSL & Native Authentication

Start free trial

Blog Footer CTA

Sign up for Elastic Cloud free trial

Jason Bryan

Надсилаючи цю форму ви погоджуєтеся з <a href="/legal/terms-of-use">Умовами надання послуг Elastic</a>. Ваші особисті дані будуть опрацьовані відповідно з <a href="/legal/privacy-statement">Положеннями про конфіденційність Elastic</a>.

Newsletter GDPR Text - Ukrainian

By submitting you acknowledge that you've read and agree to our <a href="/legal/elastic-cloud-account-terms" target="_self">Terms of Service</a>, and you agree to receive the <a href="/legal/privacy-statement#how-we-use-the-information" target="_self">selected communications</a> at the contact details you provided above. See <a href="/legal/privacy-statement/" target="_self">Elastic’s Privacy Statement</a> for more details or to opt-out at any time.

Communication Preferences - ONLY for /communication-preferences

By submitting you agree to <a href="/agreements/global/cloud-services-monthly" rel="nofollow">Elastic Cloud Terms of Service</a>. Your personal data will be processed in accordance with <a href="/legal/privacy-statement">Elastic's Privacy Statement</a>.

Cloud Trial GDPR Text

Intentionally Blank

By submitting you acknowledge that you've read and agree to our <a href="/legal/serverless-preview-terms" target="_blank">Terms of Service</a>, and that Elastic may <a href="/legal/privacy-statement#how-we-use-the-information" target="_blank">contact you</a> about our related products and services, using the details you provide above. See <a href="/legal/privacy-statement/" target="_blank">Elastic’s Privacy Statement</a> for more details or to opt-out at any time.

Serverless GDPR Text

提交即表示您確認已詳閱並同意我們的<a href="/legal/elastic-cloud-account-terms" target="_blank">服務條款</a>，且同意 Elastic 使用您在上方提供的個人資料<a href="/legal/privacy-statement#how-we-use-the-information" target="_blank">與您聯絡</a>，為您提供相關產品和服務的資訊。如需詳細說明或隨時想停止收到產品和服務資訊，請參閱 <a href="/legal/privacy-statement/" target="_blank">Elastic 的隱私聲明</a>。

Newsletter GDPR Text - TW

By submitting you acknowledge that you've read and agree to our <a href="/legal/elastic-cloud-account-terms" target="_blank">Terms of Service</a>, and that Elastic may <a href="/legal/privacy-statement#how-we-use-the-information" target="_blank">contact you</a> about our related products and services, using the details you provide above. See <a href="/legal/privacy-statement/" target="_blank">Elastic’s Privacy Statement</a> for more details or to opt-out at any time.By submitting this form, I agree to Elastic sharing my contact information with Google Cloud. I also agree to Elastic giving my information to the vendor for the purpose of shipping my food package.

GDPR Text + Google Cloud

Inviando la registrazione (1) esprimi il consenso ai <a href="/legal/terms-of-use">termini e condizioni di Elastic</a> e <a href="/legal/privacy-statement">all’informativa sulla privacy</a>, nonché (2) a ricevere saltuarie e-mail.

Newsletter GDPR Text - Italian

By submitting you acknowledge that you've read and agree to our <a href="/legal/terms-of-use" target="_blank">Terms of Service</a>, and that Elastic may <a href="/legal/privacy-statement#how-we-use-the-information" target="_blank">contact you</a> about our related products and services, using the details you provide above. See <a href="/legal/privacy-statement/" target="_blank">Elastic’s Privacy Statement</a> for more details or to opt-out at any time.

Newsletter GDPR Text

Load more

Overview

Can't make it? Register and we'll send you the recording. You'll also receive an email with related content

Can't make it? Register and we'll send you the recording. You'll also receive an email with related content.

You'll also receive an email with related content.

You'll also receive an email with related content

Speakers

Close

See more insights

The content on this page is not available in the selected language. As Elastic grows globally, we continue to support content in multiple languages.

Author

Articles by Jason Bryan

Getting Started with Elasticsearch and SSL & Native Authentication

Sign up for Elastic Cloud free trial