Elasticsearch Security

Enable SSL and Basic Authentication

Step 1: Generate server keys and self-signed certificate

Create /etc/elasticsearch/ssl directory. Make sure it has the following permissions and ownership.

drwxr-sr-x. 2 root elasticsearch    43 Sep  3 20:50 ssl

Generate keys and self-signed certificate in /etc/elasticsearch/ssl directory.

openssl req -x509 -newkey rsa:4096 -keyout es-key.pem -out es-cert.pem \
  -days 365 -subj '/CN=*.test.local' -nodes

Make sure it has the following permissions and ownership.

-rw-r--r--. 1 root elasticsearch 1814 Sep  3 20:32 es-cert.pem
-rw-r--r--. 1 root elasticsearch 3272 Sep  3 20:32 es-key.pem

Step 2: Edit Elasticsearch configuration file

Add following properties in /etc/elasticsearch/elasticsearch.yml

xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true

xpack.security.http.ssl.enabled: true
xpack.security.http.ssl.key: "/etc/elasticsearch/ssl/es-key.pem"
xpack.security.http.ssl.certificate: "/etc/elasticsearch/ssl/es-cert.pem"

Step 3: Restart Elasticsearch

systemctl stop elasticsearch
systemctl start elasticsearch

Step 4: Setup passwords for built-in users

Run the following command and enter passwords for built-in users.

/usr/share/elasticsearch/bin/elasticsearch-setup-passwords interactive

Step 5: Test SSL and basic authentication

Test HTTPS connection and basic authentication. Use built-in admin user "elastic" and the password you set in step 4.

curl -k -u elastic https://es1.test.local:9200