The 5-Minute Security Fix: How to Eliminate Your Elasticsearch's Biggest Vulnerabilities Today

The Uncomfortable Truth: Your Elasticsearch Cluster is Likely Exposed

No Authentication:
Anyone who can reach your cluster on port 9200 can read, write, or even delete your data. If your cluster is unintentionally exposed to the internet, this is an open invitation for disaster.
No Encryption (HTTP by Default):
Data exchanged between your clients and the Elasticsearch cluster, as well as between nodes in the cluster, travels in plain text. This means sensitive information can be intercepted by anyone snooping on your network.
No Granular Access Control:
Even if you have some network-level protection, once a user or application can connect, they often have full superuser-like access to all indices and operations.

Real-World Nightmares: Breaches Caused by These Exact Gaps

The Massive Data Leak (2019 & Ongoing)

Ransomware Attacks

Cryptojacking

Your 5-Minute Fix with Search Guard: A Quick-Start Guide

Prerequisites

You have an Elasticsearch cluster running.
Search Guard must be installed on every node in your Elasticsearch cluster. Mixing secured and non-secured nodes is not supported and will lead to cluster instability.

Step 1: Disable Shard Allocation

Using sgctl

./sgctl.sh rest put _cluster/settings  \
    --json '{"persistent":{"cluster.routing.allocation.enable": "none"}}'

Using curl

curl -Ss -XPUT 'https://localhost:9200/_cluster/settings?pretty' \
-H 'Content-Type: application/json' -d'
{
  "persistent": {
    "cluster.routing.allocation.enable": "none"
  }
}'

Step 2: Stop Elasticsearch

If you are running Elasticsearch with systemd:

sudo systemctl stop elasticsearch.service

If you are running Elasticsearch with SysV init:

sudo -i service elasticsearch stop

If you are running Elasticsearch as a daemon:

kill $(cat pid)

Step 3: Install Search Guard Plugin

sudo bin/elasticsearch-plugin install \
    https://maven.search-guard.com/search-guard-flx-release/com/floragunn/search-guard-flx-elasticsearch-plugin/3.0.3-es-8.17.5/search-guard-flx-elasticsearch-plugin-3.0.3-es-8.17.5.zip

Step 4: Prepare Certificates

Step 5: Add TLS Configuration

5.1 Transport Layer Encryption & Admin Certificate Configuration

Search Guard.ssl.transport.pemcert_filepath: <path_to_node_certificate>
Search Guard.ssl.transport.pemkey_filepath: <path_to_node_certificate_key>
Search Guard.ssl.transport.pemtrustedcas_filepath: <path_to_root_ca>
Search Guard.ssl.transport.enforce_hostname_verification: true
Search Guard.ssl.transport.pemkey_password: <password>  # Optional, if your private key is password-protected
Search Guard.authcz.admin_dn:
  - CN=kirk,OU=client,O=client,L=test,C=de

Search Guard.ssl.transport.pemcert_filepath:
Path to the node certificate.
Search Guard.ssl.transport.pemkey_filepath:
Path to the node certificate's private key.
Search Guard.ssl.transport.pemtrustedcas_filepath:
Path to the root certificate authority (CA) certificate.
Search Guard.ssl.transport.enforcehostnameverification:
Enforces hostname verification for added security.
Search Guard.ssl.transport.pemkey_password:
Password for the private key, if it’s protected (optional).
Search Guard.authcz.admin_dn:
Distinguished name (DN) for the admin certificate, used to configure and manage Search Guard.

5.2 REST Layer Encryption

Search Guard.ssl.http.enabled: true
Search Guard.ssl.http.pemcert_filepath: <path_to_http_certificate>
Search Guard.ssl.http.pemkey_filepath: <path_to_http_certificate_key>
Search Guard.ssl.http.pemtrustedcas_filepath: <path_to_http_root_ca>

Step 6: Restart Elasticsearch Nodes

Step 7: Re-enable Shard Allocation

./sgctl.sh rest put _cluster/settings \
    --json '{"persistent":{"cluster.routing.allocation.enable": "all"}}'

Secure Kibana with Search Guard

bin/kibana-plugin install <link-or-path-to-search-guard-kibana-plugin.zip>

elasticsearch.hosts: ["https://your-elasticsearch-host:9200"] # Use https
elasticsearch.ssl.verificationMode: none # Use 'full' or 'certificate' in production with proper certs
elasticsearch.username: "kibanaserver" # Default user for Kibana internal server
elasticsearch.password: "kibanaserver" # Default password, change in production!

Beyond the Basics: Essential Next Steps

Roles:
Collections of permissions (e.g., read_only_logs, inventory_admin).
Role Mappings:
Assign users or backend groups (like LDAP or Active Directory groups) to these roles.

Conclusion: Take Control of Your Elasticsearch Security Now