HIPAA Compliant Elasticsearch

Elastic Stack Elasticsearch
1

Will using nginx as a reverse proxy be enough to ensure that node to node communication is encrypted?

If so, then why would Add SSL support to Netty transport layer for Client/Node-to-Node communication by tlrx · Pull Request #2105 · elastic/elasticsearch · GitHub as mentioned by Paul Brown and GitHub - sonian/elasticsearch-jetty be necessary?

If not, then what is the point of Authentication | Elasticsearch JavaScript Client [8.11] | Elastic

Thanks for any information that you can help out with.

Continuing the discussion from HIPAA compliant ElasticSearch application:

2

Will using nginx as a reverse proxy be enough to ensure that node to node communication is encrypted?

No. Node to node communication doesn't go over HTTP(S) but over a custom protocol.

If not, then what is the point of Authentication | Elasticsearch JavaScript Client [8.11] | Elastic

Not sure what you mean. That's the JavaScript client library and its abilities to use HTTPS and authentication, which is useful regardless of whether you run nginx or not and has nothing to do with node to node communication.

3

Thanks for replying.

Does this mean that even though the javascript client library has the ability to use HTTPS, elasticsearch does not support client-server HTTPS unless you use shield or nginx or https://github.com/sonian/elasticsearch-jetty? That is my current understanding of what is happening.

As for node to node encryption, is https://github.com/sonian/elasticsearch-jetty a solution? What are other options? I see vague references to stunnel and ipsec, but nothing concrete and definitive. There surely was a solution before shield was released. Are there any good explanations of the custom protocol used for node to node communication? All I can see is that it binds to a port in the range of 9300 to 9400.

4

elasticsearch-jetty does not provide security.

Node-to-node TLS is availabe in Shield, e.g. https://www.elastic.co/guide/en/shield/current/separating-node-client-traffic.html

Note, even with Shield, you must maintain host keys and/or truststore/keystore on each node for TLS, which is not secure if the node is not running in a secure environment controlled by yourself like a physical machine in your private network in your data center.

5

Thanks, are there any vulnerabilities to running using nginx as a reverse proxy for client-server communication for a single node elasticsearch setup?