Security Overview

You can implement both network and application security. For most deployments, network security with public access to read-only APIs provided by application servers (API nodes) should be enough.

Network Security

  • All public traffic is routed through a load balancer / proxy server.
  • Only HTTPS protocol is available on public LAN.
  • Admin APIs are only available on private LAN.
  • It is not recommended to expose any Elasticsearch APIs to the public.
  • All public read-only APIs are provided by application servers (API nodes).

Ports

If you run a firewall, the following ports have to be open on private LAN:

Elasticsearch nodes:

  • 9200 - Elasticsearch clients connect to this port
  • 9300 - Elasticsearch nodes communicate over this port

API nodes:

  • 8000 - API clients connect to this port

Elasticsearch

Authentication

Elasticsearch supports multiple authentication schemes, such as

  • Basic
  • Mutual TLS
  • OpenID Connect
  • LDAP / Active Directory
  • Custom

Authorization

  • Role Based