# Securing Elasticsearch: Enabling Secure Mode

By Abhishek, 2025-10-13. Canonical: https://www.va2pt.com/post/securing-elasticsearch-enabling-secure-mode

> Elasticsearch is a powerful distributed search and analytics engine. However, by default, it may not run in secure mode, leaving it vulnerable to…

## Introduction
Elasticsearch is a powerful distributed search and analytics engine. However, by default, it may not run in secure mode, leaving it vulnerable to unauthorized access and data breaches. Enabling its security features ensures safe data transmission and access control.

![Introduction](/blog/securing-elasticsearch-enabling-secure-mode/img-1.webp)

## Problem Statement
Elasticsearch is operating in an unsecured state, which exposes it to risks like:

-   Unencrypted communication.

-   Unauthorized data access.

-   Potential misuse of sensitive information.

## Primary Solution: Enabling Elasticsearch Security Features
To secure Elasticsearch, enable its built-in security features such as SSL/TLS and authentication mechanisms provided by the Elastic Stack.

#### Step 1: Configure SSL/TLS for Encryption
1.  **Generate SSL Certificates**: Use the elasticsearch-certutil tool to create SSL certificates:

```
bin/elasticsearch-certutil cert --keep-ca-key --pem
```

2.  This generates the CA and certificates in a .zip file.

2.  **Distribute Certificates**: Copy the certificates to the appropriate directories on each Elasticsearch node.

3.  **Update Elasticsearch Configuration**: Edit elasticsearch.yml to include the SSL settings:

    yaml

```
xpack.security.enabled: true xpack.security.transport.ssl.enabled: true xpack.security.transport.ssl.verification_mode: certificate xpack.security.transport.ssl.key: /path/to/node.key xpack.security.transport.ssl.certificate: /path/to/node.crt xpack.security.transport.ssl.certificate_authorities: ["/path/to/ca.crt"] xpack.security.http.ssl.enabled: true xpack.security.http.ssl.key: /path/to/node-http.key xpack.security.http.ssl.certificate: /path/to/node-http.crt xpack.security.http.ssl.certificate_authorities: ["/path/to/ca.crt"]
```

4.  **Restart Elasticsearch**: Apply the changes by restarting the service:

```bash
sudo systemctl restart elasticsearch
```

#### Step 2: Set Up Authentication
1.  **Enable User Authentication**: Add the following in elasticsearch.yml:

    yaml

```
xpack.security.authc.realms.native.native1: order: 0
```

2.  **Create Users and Roles**: Use elasticsearch-users to create users and assign roles:

```
bin/elasticsearch-users useradd admin -p <password> -r superuser
```

3.  **Test Authentication**: Access Elasticsearch with the configured credentials:

```bash
curl -u admin https://<elasticsearch-url>:9200/_cluster/health --insecure
```

### Why This Solution is Best
-   **Comprehensive Security**: Provides encryption (SSL/TLS) and authentication in one configuration.

-   **Built-in Features**: Utilizes the Elastic Stack's native tools, avoiding third-party dependencies.

-   **Scalability**: Supports cluster-wide secure communication across all nodes.

### Alternate Solutions
#### 1\. Use a Reverse Proxy with TLS Termination
1.  **Set Up a Reverse Proxy**: Use Nginx or Apache as a reverse proxy.

2.  **Configure TLS**: Terminate SSL at the proxy level by configuring certificates in the proxy server.

    Example Nginx configuration

```nginx
server {
    listen 443 ssl;
    server_name elasticsearch.example.com;
    ssl_certificate /etc/nginx/ssl/server.crt;
    ssl_certificate_key /etc/nginx/ssl/server.key;
    location / {
        proxy_pass http://localhost:9200;
        proxy_set_header Host $host;
    }
}
```

**Advantages**:

-   Simplifies certificate management.

-   Centralizes SSL handling at the proxy layer.

#### 2\. Configure Firewall Rules
1.  **Restrict Access**: Use firewall rules to limit access to Elasticsearch.Example for UFW:

```bash
sudo ufw allow from <trusted-ip-range> to any port 9200
```

2.  **Combine with IP Whitelisting**: Configure Elasticsearch to listen only on trusted IPs:

    yaml

```
network.host: ["127.0.0.1", "<trusted-ip>"]
```

**Advantages**:

-   Limits exposure to trusted networks only.

-   Quick and easy to implement.

## Conclusion
Running Elasticsearch in secure mode is essential to protect sensitive data and maintain compliance with security standards. Enabling its built-in security features is the most effective and scalable solution. Alternate approaches, such as using a reverse proxy or configuring firewalls, provide additional layers of security, catering to specific use cases or environments. Combining these strategies ensures a robust and secure Elasticsearch deployment.

---

Published by VA2PT (https://www.va2pt.com). Related service: https://www.va2pt.com/devsecops-services