4

There appears to be a serious lack of information on this despite the fact that as installed elasticsearch is extremely exploitable.

My main fear in using it is that as a non-expert I have no idea what the possible vulnerabilities are and how to close them.

Can someone explain to me a method of locking down elasticsearch so that I can do the following within a secure environment:

  • Multiple indices per user. Assume I can create this for them in advance, a user should not be able to perform operations on other user's indices, except possibly query them if granted permission. (Possibly some form of secret key in the URL for each user?)

  • Users can add and delete objects from their indices at will but not drop their index.

  • Some form of limitation to memory size for the user, so that if something goes wrong they can't overload the service.

I'm guessing some of this has to be done at an application level and I can't expect you to write this for me, however the default configuration is far too open and even if I provide a custom API layer to this someone could easily bypass it and communicate directly with the server.

Improve this question

4 Answers 4

Reset to default
2

In my opinion the only way to secure ES in the way you ask is to lock it behind another application layer and have that layer handle https/ssl transport, authentication and authorization control.

On ES side of things there was a jetty ES security plugin developed, do not know if it was successful, when I was deploying ES first time the plugin was about to be released so look at it:

ES JETTY PLUGIN

Improve this answer
2
  • But is there any documentation on locking it so? I am willing to build an API using the PHP client, however I am not comfortable I know how to ensure that elasticsearch can only be communicated to via my application. I have considered localhost only but I don't want another person with the ability to generate PHP scripts on the server to be able to bypass it.
    – George Reith
    Dec 20, 2013 at 15:36
  • Heh, not really. At least not the official one I know of, or anything I bumped into. You can ask the devs directly on IRC #freenode #elasticsearch channel, they might suggest something.
    – Danila Ladner
    Dec 20, 2013 at 15:39
1

I guess you would need to create an in-between HTTP proxy with all this "business logic", and only allow ElasticSearch access from the localhost. This way direct access to ES is blocked and you get to determine and enforce any policies you'd like (yay! ;)

"even if I provide a custom API layer to this someone could easily bypass it": they cannot if ES only accepts connections from the localhost.

I don't think memory usage limits are possible, maybe you could pre-approve queries within the proxy layer?

Improve this answer
0

I did something similar using Nginx running in front of ES. It is possible to setup "authorization" in Nginx based on the keywords in the URL. Refer to the use case defined in this document: http://www.elasticsearch.org/blog/playing-http-tricks-nginx/

Improve this answer
0

I bound elasticsearch to an openvpn tunnel:

In /etc/elasticsearch/elasticsearch.yml:

network.host: 172.16.xxx.xxx

Where 172.16.xxx.xxx is the IP addresses assigned by openvpn.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .