# Discovery zen ping and password protected ES **URL:** \ **Category:** Elasticsearch\ **Created:** [October 29, 2018, 6:16pm UTC](https://discuss.elastic.co/t/discovery-zen-ping-and-password-protected-es/154483 "2018-10-29T18:16:25Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![wheelq](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wheelq/32/35893_2.png) [@wheelq](https://discuss.elastic.co/u/wheelq)\ **Post date:** [October 29, 2018, 6:16pm UTC](https://discuss.elastic.co/t/discovery-zen-ping-and-password-protected-es/154483/1 "2018-10-29T18:16:25Z")
Any idea how does this work with password protected ES nodes? I'm just about to test it but I need to make backups first 😉 ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [October 30, 2018, 1:58am UTC](https://discuss.elastic.co/t/discovery-zen-ping-and-password-protected-es/154483/2 "2018-10-30T01:58:55Z")
That's a very vague question about a fairly in depth topic. The short answer is that all internode communication, including discovery pings, use the transport port (9300) not the http port (9200), and the security model for the transport port is not the same as the http port. Transport port doesn't require passwords, it is secured using TLS. ---
**Author:** ![wheelq](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wheelq/32/35893_2.png) [@wheelq](https://discuss.elastic.co/u/wheelq)\ **Post date:** [October 30, 2018, 11:38am UTC](https://discuss.elastic.co/t/discovery-zen-ping-and-password-protected-es/154483/3 "2018-10-30T11:38:06Z")
Ok, thanks, but how does the ping work exactly? I thought this also has to be secured, so no other rogue node could advertise itself as a part of a cluster. ---
**Author:** ![wheelq](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wheelq/32/35893_2.png) [@wheelq](https://discuss.elastic.co/u/wheelq)\ **Post date:** [October 31, 2018, 2:38pm UTC](https://discuss.elastic.co/t/discovery-zen-ping-and-password-protected-es/154483/4 "2018-10-31T14:38:34Z")
> it is secured using TLS. by default? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [October 31, 2018, 8:22pm UTC](https://discuss.elastic.co/t/discovery-zen-ping-and-password-protected-es/154483/5 "2018-10-31T20:22:20Z")
It will ping for other nodes, then if it gets a response it'll validate that using TLS. This is a good example of how it all works - [https://www.ibm.com/support/knowledgecenter/en/SSFKSJ\_7.1.0/com.ibm.mq.doc/sy10660\_.htm](https://www.ibm.com/support/knowledgecenter/en/SSFKSJ_7.1.0/com.ibm.mq.doc/sy10660_.htm) ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [October 31, 2018, 11:23pm UTC](https://discuss.elastic.co/t/discovery-zen-ping-and-password-protected-es/154483/6 "2018-10-31T23:23:27Z")
> [@wheelq](#): > > by default? Yes, in Elasticsearch 6.x, TLS is required for internode communication. I'm happy to explain how it all works, but a complete & detailed answer would take several pages of explanation and diagrams. If you've read through our docs, and have specific questions then please ask and I'll do my best to answer them, but I can't write an ad-hoc whitepaper on cluster security models. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [November 1, 2018, 1:00am UTC](https://discuss.elastic.co/t/discovery-zen-ping-and-password-protected-es/154483/7 "2018-11-01T01:00:04Z")
> [@TimV](#): > > Yes, in Elasticsearch 6.x, TLS is required for internode communication. @warkolm pointed out that this anwers skips some details that might be helpful. My assumption when you talk about "password proected ES" is that you're referring to using [our Elastic Stack security features](https://www.elastic.co/products/stack/security). In that context, if you have security enabled on a production (non-trial) license, then TLS is required. In our security model: - For the HTTP (Rest) interface, passwords are the default authentication mechanism (although we support other options like TLS certs ("pki"), SAML and Kerberos). - For transport (internode) communication, including pings, we secure the cluster membership via TLS certs. Those are pretty much tied together - you can't have one without the other (\*). (\*) Technically, you can enable anonymous access to some actions which is a bit like having TLS without having passwords, but it's not exactly the same. ---
**Author:** ![wheelq](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wheelq/32/35893_2.png) [@wheelq](https://discuss.elastic.co/u/wheelq)\ **Post date:** [November 1, 2018, 8:38am UTC](https://discuss.elastic.co/t/discovery-zen-ping-and-password-protected-es/154483/8 "2018-11-01T08:38:35Z")
Thanks for the explanation, but my question was about the communication on port 9300. Here is a list of detailed queries: - On port 9300, is the communication encrypted by default or not? - If not, then how can I turn it on - How can I manage encryption on port 9300 (assuming positive answers to the queries above) via the yml files? In terms of login, password, location of the crt files etc - What is exactly happening on port 9300. I know I can use wireshark etc, but can I find any technical documentation or more details about the communication on port 9300? Thanks. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [November 1, 2018, 9:12am UTC](https://discuss.elastic.co/t/discovery-zen-ping-and-password-protected-es/154483/9 "2018-11-01T09:12:50Z")
See: [https://www.elastic.co/guide/en/elastic-stack-overview/6.4/encrypting-communications.html](https://www.elastic.co/guide/en/elastic-stack-overview/6.4/encrypting-communications.html) ---
**Author:** ![wheelq](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wheelq/32/35893_2.png) [@wheelq](https://discuss.elastic.co/u/wheelq)\ **Post date:** [November 1, 2018, 10:08am UTC](https://discuss.elastic.co/t/discovery-zen-ping-and-password-protected-es/154483/10 "2018-11-01T10:08:51Z")
Checked it. No technical details and no information about 9300 communications ---
**Author:** ![Yogesh\_Gaikwad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yogesh_gaikwad/32/27025_2.png) [@Yogesh\_Gaikwad](https://discuss.elastic.co/u/Yogesh_Gaikwad)\ **Post date:** [November 1, 2018, 11:12am UTC](https://discuss.elastic.co/t/discovery-zen-ping-and-password-protected-es/154483/11 "2018-11-01T11:12:45Z")
Hi @wheelq, Did you check the next chapters following the links in the documentation, say [https://www.elastic.co/guide/en/elastic-stack-overview/6.4/ssl-tls.html](https://www.elastic.co/guide/en/elastic-stack-overview/6.4/ssl-tls.html) [https://www.elastic.co/guide/en/elasticsearch/reference/6.4/configuring-tls.html#tls-transport](https://www.elastic.co/guide/en/elasticsearch/reference/6.4/configuring-tls.html#tls-transport) Hope this helps. ---
**Author:** ![wheelq](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wheelq/32/35893_2.png) [@wheelq](https://discuss.elastic.co/u/wheelq)\ **Post date:** [November 1, 2018, 12:44pm UTC](https://discuss.elastic.co/t/discovery-zen-ping-and-password-protected-es/154483/12 "2018-11-01T12:44:12Z")
Yes, I have checked. All of those links redirect to other links which end up with redirection to the original links. Just walking in circles, and being pushed to use x-pack and provide information how to configure tls...which again, was not my question. I am after technical documentation, information, what is happening on port 9300 (structure of the packets, communication type) without using x-pack. If there is no such document than I'll investigate this myself ---
**Author:** ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)\ **Post date:** [November 1, 2018, 1:07pm UTC](https://discuss.elastic.co/t/discovery-zen-ping-and-password-protected-es/154483/13 "2018-11-01T13:07:45Z")
> [@wheelq](#): > > I am after technical documentation, information, what is happening on port 9300 (structure of the packets, communication type) without using x-pack. There is no such documentation. The details of the protocol that Elasticsearch uses for inter-node communication is deliberately undocumented as it varies, possibly wildly, from version to version. You can read the source code of a particular version if you're interested in that version's protocol (see, for instance, `TcpTransport#buildMessage` in recent versions) but be warned that it may change in future. I do not understand how this pertains to your original question on password protection. There is no password-protection functionality in this protocol. To ensure integrity or authenticity of inter-node communication, you should use the security features provided by X-pack. ---
**Author:** ![wheelq](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wheelq/32/35893_2.png) [@wheelq](https://discuss.elastic.co/u/wheelq)\ **Post date:** [November 1, 2018, 1:44pm UTC](https://discuss.elastic.co/t/discovery-zen-ping-and-password-protected-es/154483/14 "2018-11-01T13:44:59Z")
thanks ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 29, 2018, 1:45pm UTC](https://discuss.elastic.co/t/discovery-zen-ping-and-password-protected-es/154483/15 "2018-11-29T13:45:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.