When I enables security in Elasticsearch, I can't visit it using just curl "hostname:9200/" unless I add curl -u username:password. And I just used built-in users of elastic.
Is this what security feature means by requiring authentication?
That is one aspect, yes.