# Enabling security on production cluster without downtime

**URL:** <https://discuss.elastic.co/t/enabling-security-on-production-cluster-without-downtime/230105>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [April 28, 2020, 8:28am UTC](https://discuss.elastic.co/t/enabling-security-on-production-cluster-without-downtime/230105 "2020-04-28T08:28:11Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Petr.Simik](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/petr.simik/32/38082_2.png) [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\
**Post date:** [April 28, 2020, 8:28am UTC](https://discuss.elastic.co/t/enabling-security-on-production-cluster-without-downtime/230105/1 "2020-04-28T08:28:12Z")

</div>

Need advice:  
is there a way how to enable security on multi-node production cluster without downtime?

in tutorial  
[https://www.elastic.co/guide/en/elasticsearch/reference/current/security-getting-started.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-getting-started.html)  
it is described that all nodes needs to be restarted.

Can I restart the one with security (anonymous enabled so other nodes can join) and later remove anonymous access?

thank you

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [April 28, 2020, 9:15am UTC](https://discuss.elastic.co/t/enabling-security-on-production-cluster-without-downtime/230105/2 "2020-04-28T09:15:46Z")

</div>

Nodes without security can not talk to nodes that require communication to be encrypted which is why all nodes need to be restarted and downtime required.

---

<div class="post-metadata">

**Author:** ![Petr.Simik](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/petr.simik/32/38082_2.png) [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\
**Post date:** [April 29, 2020, 5:09am UTC](https://discuss.elastic.co/t/enabling-security-on-production-cluster-without-downtime/230105/3 "2020-04-29T05:09:39Z")

</div>

@Christian_Dahlqvist thank you.  
The cluster is behind the firewall in private network I do not plan to enable ssl, just the security.

```auto
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: false

```

What is the correct strategy?  
Stop all nodes & kibana.  
Modify elasticsearch.yml on all nodes. (enable security)  
Start nodes.

THX

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [April 29, 2020, 5:24am UTC](https://discuss.elastic.co/t/enabling-security-on-production-cluster-without-downtime/230105/4 "2020-04-29T05:24:21Z")

</div>

Security requires TLS to be enabled. See [the docs](https://www.elastic.co/guide/en/elasticsearch/reference/current/configuring-security.html) for further details.

---

<div class="post-metadata">

**Author:** ![Petr.Simik](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/petr.simik/32/38082_2.png) [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\
**Post date:** [April 29, 2020, 5:36am UTC](https://discuss.elastic.co/t/enabling-security-on-production-cluster-without-downtime/230105/5 "2020-04-29T05:36:22Z")

</div>

@Christian_Dahlqvist thank you

I plan to execute this as ansible script to minimise the downtime.

What is the correct process.  
stop all nodes  
generate password on one master node and start all nodes with that password or do I have to repeat elasticsearch-setup-passwords on each node?

> ./bin/elasticsearch-setup-passwords auto

is there a doc where setup of security on cluster is described?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 27, 2020, 5:43am UTC](https://discuss.elastic.co/t/enabling-security-on-production-cluster-without-downtime/230105/6 "2020-05-27T05:43:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.