mirror of
https://github.com/honeymoose/OpenSearch.git
synced 2025-02-08 05:58:44 +00:00
f2cbe20ea0
This is related to elastic/x-pack-elasticsearch#1217. This PR removes the default password of "changeme" from the reserved users. This PR adds special behavior for authenticating the reserved users. No ReservedRealm user can be authenticated until its password is set. The one exception to this is the elastic user. The elastic user can be authenticated with an empty password if the action is a rest request originating from localhost. In this scenario where an elastic user is authenticated with a default password, it will have metadata indicating that it is in setup mode. An elastic user in setup mode is only authorized to execute a change password request. Original commit: elastic/x-pack-elasticsearch@e1e101a237
79 lines
3.5 KiB
Plaintext
79 lines
3.5 KiB
Plaintext
[[separating-node-client-traffic]]
|
|
=== Separating node-to-node and client traffic
|
|
|
|
Elasticsearch has the feature of so called {ref}/modules-transport.html#_tcp_transport_profiles[TCP transport profiles]
|
|
that allows it to bind to several ports and addresses. {security} extends on this
|
|
functionality to enhance the security of the cluster by enabling the separation
|
|
of node-to-node transport traffic from client transport traffic. This is important
|
|
if the client transport traffic is not trusted and could potentially be malicious.
|
|
To separate the node-to-node traffic from the client traffic, add the following
|
|
to `elasticsearch.yml`:
|
|
|
|
[source, yaml]
|
|
--------------------------------------------------
|
|
transport.profiles.client: <1>
|
|
port: 9500-9600 <2>
|
|
shield:
|
|
type: client <3>
|
|
--------------------------------------------------
|
|
<1> `client` is the name of this example profile
|
|
<2> The port range that will be used by transport clients to communicate with
|
|
this cluster
|
|
<3> Categorizes the profile as a `client`. This accounts for additional security
|
|
filters by denying request attempts on for internal cluster operations
|
|
(e.g shard level actions and ping requests) from this profile.
|
|
|
|
If supported by your environment, an internal network can be used for node-to-node
|
|
traffic and public network can be used for client traffic by adding the following
|
|
to `elasticsearch.yml`:
|
|
|
|
[source, yaml]
|
|
--------------------------------------------------
|
|
transport.profiles.default.bind_host: 10.0.0.1 <1>
|
|
transport.profiles.client.bind_host: 1.1.1.1 <2>
|
|
--------------------------------------------------
|
|
<1> The bind address for the network that will be used for node-to-node communication
|
|
<2> The bind address for the network used for client communication
|
|
|
|
If separate networks are not available, then <<ip-filtering, IP Filtering>> can
|
|
be enabled to limit access to the profiles.
|
|
|
|
The TCP transport profiles also allow for enabling SSL on a per profile basis.
|
|
This is useful if you have a secured network for the node-to-node communication,
|
|
but the client is on an unsecured network. To enable SSL on a client profile when
|
|
SSL is disabled for node-to-node communication, add the following to
|
|
`elasticsearch.yml`:
|
|
|
|
[source, yaml]
|
|
--------------------------------------------------
|
|
transport.profiles.client.xpack.security.ssl.enabled: true <1>
|
|
--------------------------------------------------
|
|
<1> This enables SSL on the client profile. The default value for this setting
|
|
is the value of `xpack.security.transport.ssl.enabled`.
|
|
|
|
When using SSL for transport, a different set of certificates can also be used
|
|
for the client traffic by adding the following to `elasticsearch.yml`:
|
|
|
|
[source, yaml]
|
|
--------------------------------------------------
|
|
transport.profiles.client.xpack.security.ssl.truststore:
|
|
path: /path/to/another/truststore
|
|
password: x-pack-test-password
|
|
|
|
transport.profiles.client.xpack.security.ssl.keystore:
|
|
path: /path/to/another/keystore
|
|
password: x-pack-test-password
|
|
--------------------------------------------------
|
|
|
|
To change the default behavior that requires certificates for transport clients,
|
|
set the following value in the `elasticsearch.yml` file:
|
|
|
|
[source, yaml]
|
|
--------------------------------------------------
|
|
transport.profiles.client.xpack.security.ssl.client_authentication: no
|
|
--------------------------------------------------
|
|
|
|
This setting keeps certificate authentication active for node-to-node traffic,
|
|
but removes the requirement to distribute a signed certificate to transport
|
|
clients. Please see the <<transport-client, Transport Client>> section.
|