# Securing Elasticsearch **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [November 29, 2017, 11:24am UTC](https://community.graylog.org/t/securing-elasticsearch/3323 "2017-11-29T11:24:48Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![okelet](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/okelet/32/1505_2.png) [@okelet](https://community.graylog.org/u/okelet)\ **Post date:** [November 29, 2017, 11:24am UTC](https://community.graylog.org/t/securing-elasticsearch/3323/1 "2017-11-29T11:24:48Z")
Hi, I’ve Graylog running, without any problems. It is running since 3 months ago, with a medium load. Some basic stats: 60 indices, 304,261,633 documents, 121.2GB (2 graylog servers and 3 elasticsearch servers, 3 shards and 1 replica). But we have Elasticsearch unsecured… Anyone can connect and do what the want. I could set some iptables rules, but I think that is too much simple and insecure. I have been reading about x-pack and search guard, but documentation is not clear for me. I just want to set up a local user with a password (no LDAP or AD), and tell graylog to connect to elasticsearch using those credentials. What is the best approach to do this? Perhaps, I would also configure Elasticsearch to use SSL with self signed certificates. How would Graylog behave with self signed certificates? One more question, how would authentication and ssl affect elasticsearch replication? Kind regards. ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [November 29, 2017, 12:25pm UTC](https://community.graylog.org/t/securing-elasticsearch/3323/2 "2017-11-29T12:25:50Z")
> [@okelet](#): > > I could set some iptables rules, but I think that is too much simple and insecure. Why? If you allow only your Graylog nodes to connect to Elasticsearch, it should be fine. ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [November 29, 2017, 1:49pm UTC](https://community.graylog.org/t/securing-elasticsearch/3323/3 "2017-11-29T13:49:22Z")
maybe you can read on this: > **[Playing HTTP Tricks with Nginx | Elastic](https://www.elastic.co/blog/playing-http-tricks-nginx)** > > Update November 2, 2015: If you're interested in advanced access control configuration or other security features, consider taking Shield, security for Elasticsearch, for a spin. One of the defining f... ---
**Author:** ![okelet](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/okelet/32/1505_2.png) [@okelet](https://community.graylog.org/u/okelet)\ **Post date:** [November 29, 2017, 2:22pm UTC](https://community.graylog.org/t/securing-elasticsearch/3323/4 "2017-11-29T14:22:02Z")
Hi @jochen, iptables is a simple solution that could work in some environments. We don’t want to do this because if so we need to manage and collect all possible Graylog and ElasticSearch IPs and modify all of the nodes when adding or removing a node; so we can’t auto scale (in case of Graylog; for ElasticSearch I think autoscale, without discovery, could be even more difficult). Using some kind of authentication and SSL, and auto-provisioning the servers with the credentials, shouldn’t be a problem. ---
**Author:** ![okelet](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/okelet/32/1505_2.png) [@okelet](https://community.graylog.org/u/okelet)\ **Post date:** [November 29, 2017, 2:24pm UTC](https://community.graylog.org/t/securing-elasticsearch/3323/5 "2017-11-29T14:24:36Z")
Thanks @jan, this could be a simple solution without having to add more complexity using x-pack or simple guard, and adding SSL certificates should also be easy. In the side of ElasticSearch, I don’t know much about it. How should we configure each Elasticsearch node to connect to the others using credentials? ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [November 29, 2017, 2:46pm UTC](https://community.graylog.org/t/securing-elasticsearch/3323/6 "2017-11-29T14:46:48Z")
> [@okelet](#): > > How should we configure each Elasticsearch node to connect to the others using credentials? Elasticsearch nodes are not using the HTTP API to communicate with each other. ---
**Author:** ![okelet](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/okelet/32/1505_2.png) [@okelet](https://community.graylog.org/u/okelet)\ **Post date:** [November 29, 2017, 3:14pm UTC](https://community.graylog.org/t/securing-elasticsearch/3323/7 "2017-11-29T15:14:21Z")
> [@jochen](#): > > Elasticsearch nodes are not using the HTTP API to communicate with each other. So, is not needed to secure the communication of the Elasticsearch servers? Or how should I do that? Thanks and sorry for this off-topic. ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [November 29, 2017, 3:31pm UTC](https://community.graylog.org/t/securing-elasticsearch/3323/8 "2017-11-29T15:31:42Z")
> [@okelet](#): > > So, is not needed to secure the communication of the Elasticsearch servers? Or how should I do that? If you don’t secure the transport ports of your Elasticsearch nodes, any “rogue” node could join the cluster as a client node and provide an unsecured HTTP API. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [December 13, 2017, 3:31pm UTC](https://community.graylog.org/t/securing-elasticsearch/3323/9 "2017-12-13T15:31:50Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.