Elasticsearch Security
Enable SSL and Basic Authentication
Step 1: Generate server keys and self-signed certificate
Create /etc/elasticsearch/ssl directory. Make sure it has the following permissions and ownership.
drwxr-sr-x. 2 root elasticsearch 43 Sep 3 20:50 ssl
Generate keys and self-signed certificate in /etc/elasticsearch/ssl directory.
openssl req -x509 -newkey rsa:4096 -keyout es-key.pem -out es-cert.pem \ -days 365 -subj '/CN=*.test.local' -nodes
Make sure it has the following permissions and ownership.
-rw-r--r--. 1 root elasticsearch 1814 Sep 3 20:32 es-cert.pem -rw-r--r--. 1 root elasticsearch 3272 Sep 3 20:32 es-key.pem
Step 2: Edit Elasticsearch configuration file
Add following properties in /etc/elasticsearch/elasticsearch.yml
xpack.security.enabled: true xpack.security.transport.ssl.enabled: true xpack.security.http.ssl.enabled: true xpack.security.http.ssl.key: "/etc/elasticsearch/ssl/es-key.pem" xpack.security.http.ssl.certificate: "/etc/elasticsearch/ssl/es-cert.pem"
Step 3: Restart Elasticsearch
systemctl stop elasticsearch systemctl start elasticsearch
Step 4: Setup passwords for built-in users
Run the following command and enter passwords for built-in users.
/usr/share/elasticsearch/bin/elasticsearch-setup-passwords interactive
Step 5: Test SSL and basic authentication
Test HTTPS connection and basic authentication. Use built-in admin user "elastic" and the password you set in step 4.
curl -k -u elastic https://es1.test.local:9200