# Elasticsearch plugin settings encryption

**URL:** <https://discuss.elastic.co/t/elasticsearch-plugin-settings-encryption/90988>\
**Category:** Elasticsearch\
**Created:** [June 27, 2017, 3:04pm UTC](https://discuss.elastic.co/t/elasticsearch-plugin-settings-encryption/90988 "2017-06-27T15:04:48Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![shyampr](https://avatars.discourse-cdn.com/v4/letter/s/838e76/32.png) [@shyampr](https://discuss.elastic.co/u/shyampr)\
**Post date:** [June 27, 2017, 3:04pm UTC](https://discuss.elastic.co/t/elasticsearch-plugin-settings-encryption/90988/1 "2017-06-27T15:04:48Z")

</div>

We are writing a repository plugin, and few of the settings in that plugin must be encrypted or at-least not shown in GET API. I could not find good example of such a setting. Right now we are using the following  
Setting AUTHINFO =  
Setting.simpleString("authinfo", Setting.Property.Filtered);  
But even in this case, the authinfo is returned back in plain text when we query for the repository(GET \_snapshot/my\_repo).  
Is the only choice in such cases is to store the details in elasticsearch keystore as explained here - [https://www.elastic.co/guide/en/elasticsearch/reference/current/secure-settings.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/secure-settings.html) or do we have any other choice. If we create a keystore, the same command has to be replicated in all the members of the cluster or will the keystore be transferred automatically?

---

<div class="post-metadata">

**Author:** ![rjernst](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rjernst/32/6363_2.png) [@rjernst](https://discuss.elastic.co/u/rjernst)\
**Post date:** [June 27, 2017, 10:32pm UTC](https://discuss.elastic.co/t/elasticsearch-plugin-settings-encryption/90988/2 "2017-06-27T22:32:55Z")

</div>

The keystore must exist on each node at startup. That is the intended way to have a secure setting. This would mean loading your secure settings at plugin initialization, instead of during repository creation. See for example the repository-s3 plugin.

---

<div class="post-metadata">

**Author:** ![shyampr](https://avatars.discourse-cdn.com/v4/letter/s/838e76/32.png) [@shyampr](https://discuss.elastic.co/u/shyampr)\
**Post date:** [June 28, 2017, 6:24am UTC](https://discuss.elastic.co/t/elasticsearch-plugin-settings-encryption/90988/3 "2017-06-28T06:24:13Z")

</div>

Somehow I feel this is really not docker friendly as it will mean that we will need separate images for test/production if separate credentials are to be used. And putting the credential at docker build time seems a bit weird, I think we will need to mount the keystore file while using docker rather than hard-coding it inside the container.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 26, 2017, 6:24am UTC](https://discuss.elastic.co/t/elasticsearch-plugin-settings-encryption/90988/4 "2017-07-26T06:24:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.