|
1 | | -[role="xpack"] |
2 | | -[[elasticsearch-security]] |
3 | | -= Securing the {stack} |
| 1 | +[[secure-cluster]] |
| 2 | += Secure a cluster |
4 | 3 |
|
5 | 4 | [partintro] |
6 | 5 | -- |
7 | 6 | The {stack-security-features} enable you to easily secure a cluster. You can |
8 | 7 | password-protect your data as well as implement more advanced security |
9 | 8 | measures such as encrypting communications, role-based access control, |
10 | | -IP filtering, and auditing. This guide describes how to configure the security |
11 | | -features you need, and interact with your secured cluster. |
12 | | - |
13 | | -Security protects Elasticsearch clusters by: |
14 | | - |
15 | | -* <<preventing-unauthorized-access, Preventing unauthorized access>> |
16 | | - with password protection, role-based access control, and IP filtering. |
17 | | -* <<preserving-data-integrity, Preserving the integrity of your data>> |
18 | | - with message authentication and SSL/TLS encryption. |
19 | | -* <<maintaining-audit-trail, Maintaining an audit trail>> |
20 | | - so you know who's doing what to your cluster and the data it stores. |
21 | | - |
22 | | -[float] |
23 | | -[[preventing-unauthorized-access]] |
24 | | -=== Preventing unauthorized access |
25 | | - |
26 | | -To prevent unauthorized access to your Elasticsearch cluster, you must have a |
27 | | -way to _authenticate_ users. This simply means that you need a way to validate |
28 | | -that a user is who they claim to be. For example, you have to make sure only |
29 | | -the person named _Kelsey Andorra_ can sign in as the user `kandorra`. The |
30 | | -{es-security-features} provide a standalone authentication mechanism that enables |
31 | | -you to quickly password-protect your cluster. If you're already using |
32 | | -<<ldap-realm, LDAP>>, <<active-directory-realm, Active Directory>>, or |
33 | | -<<pki-realm, PKI>> to manage users in your organization, the {security-features} |
34 | | -are able to integrate with those systems to perform user authentication. |
35 | | - |
36 | | -In many cases, simply authenticating users isn't enough. You also need a way to |
37 | | -control what data users have access to and what tasks they can perform. The |
38 | | -{es-security-features} enable you to _authorize_ users by assigning access |
39 | | -_privileges_ to _roles_ and assigning those roles to users. For example, this |
40 | | -<<authorization,role-based access control>> mechanism (a.k.a RBAC) enables |
41 | | -you to specify that the user `kandorra` can only perform read operations on the |
42 | | -`events` index and can't do anything at all with other indices. |
43 | | - |
44 | | -The {security-features} also support <<ip-filtering, IP-based authorization>>. |
45 | | -You can whitelist and blacklist specific IP addresses or subnets to control |
46 | | -network-level access to a server. |
47 | | - |
48 | | -[float] |
49 | | -[[preserving-data-integrity]] |
50 | | -=== Preserving data integrity |
51 | | - |
52 | | -A critical part of security is keeping confidential data confidential. |
53 | | -Elasticsearch has built-in protections against accidental data loss and |
54 | | -corruption. However, there's nothing to stop deliberate tampering or data |
55 | | -interception. The {stack-security-features} preserve the integrity of your |
56 | | -data by <<ssl-tls, encrypting communications>> to and from nodes. For even |
57 | | -greater protection, you can increase the {ref}/ciphers.html[encryption strength]. |
58 | | - |
59 | | -[float] |
60 | | -[[maintaining-audit-trail]] |
61 | | -=== Maintaining an audit trail |
62 | | - |
63 | | -Keeping a system secure takes vigilance. By using {stack-security-features} to |
64 | | -maintain an audit trail, you can easily see who is accessing your cluster and |
65 | | -what they're doing. By analyzing access patterns and failed attempts to access |
66 | | -your cluster, you can gain insights into attempted attacks and data breaches. |
67 | | -Keeping an auditable log of the activity in your cluster can also help diagnose |
68 | | -operational issues. |
69 | | - |
70 | | -[float] |
71 | | -=== Where to Go Next |
72 | | - |
73 | | -* <<security-getting-started, Getting Started>> |
74 | | - steps through how to install and start using Security for basic authentication. |
75 | | - |
76 | | -* <<how-security-works, How Security Works>> |
77 | | - provides more information about how Security supports user authentication, |
78 | | - authorization, and encryption. |
79 | | - |
80 | | -* <<ccs-clients-integrations>> |
81 | | - shows you how to interact with an Elasticsearch cluster protected by the |
82 | | - {stack-security-features}. |
83 | | - |
84 | | -[float] |
85 | | -=== Have Comments, Questions, or Feedback? |
86 | | - |
87 | | -Head over to our {security-forum}[Security Discussion Forum] |
88 | | -to share your experience, questions, and suggestions. |
| 9 | +IP filtering, and auditing. |
| 10 | + |
| 11 | +* <<elasticsearch-security>> |
| 12 | +* <<configuring-security>> |
| 13 | + |
89 | 14 | -- |
90 | 15 |
|
| 16 | +include::overview.asciidoc[] |
| 17 | + |
| 18 | +include::configuring-es.asciidoc[] |
| 19 | + |
91 | 20 | include::how-security-works.asciidoc[] |
92 | 21 |
|
93 | 22 | include::authentication/index.asciidoc[] |
|
0 commit comments