# Hosting and securing ElasticSearch **URL:** \ **Category:** Elasticsearch\ **Created:** [January 31, 2011, 5:57pm UTC](https://discuss.elastic.co/t/hosting-and-securing-elasticsearch/3852 "2011-01-31T17:57:49Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Administrator\_2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/administrator_2/32/3211_2.png) [@Administrator\_2](https://discuss.elastic.co/u/Administrator_2)\ **Post date:** [January 31, 2011, 5:57pm UTC](https://discuss.elastic.co/t/hosting-and-securing-elasticsearch/3852/1 "2011-01-31T17:57:49Z")
``` I've been looking at ElasticSearch and I'm a huge fan of ``` what I'm seeing so far. I'm currently using [Lucene.NET](http://Lucene.NET) on my site ([sf4answers.com](http://sf4answers.com)) to perform searching, but I feel that I'd rather not have to deal with a lot of the overhead that comes with it. ``` I was considering SOLR, but ElasticSearch is much, much more ``` appealing to me. ``` However, I have a few questions, and I'm hoping I can find ``` some good answers here (and trust me, I've tried to look): ``` My website is currently running on a shared hosting solution ``` with [ASP.NET](http://ASP.NET) (on [discountasp.net](http://discountasp.net)). To that end, I'd use the .NET client to access ElasticSearch hosted on another domain/ip address. ``` That said, are there hosting providers that will let me host ``` a JVM and expose the HTTP endpoint that ElasticSearch requires? If so, could anyone point me to some trusted providers (I will admit to not knowing much about non-Windows hosting platforms). ``` Also, how would I secure the operations between the ASP.NET ``` host and whatever is hosting the JVM? I was hoping there would be an HTTPS endpoint (with a self issued certificate), but there doesn't seem to be one. This is a huge concern to me, because I don't want to just leave my search index out in the wild open to anyone who wants to place entries into it. ``` Any insight into this would be greatly appreciated, and ``` thanks in advance. ``` - Nick ``` ---
**Author:** ![kimchy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kimchy/32/44952_2.png) [@kimchy](https://discuss.elastic.co/u/kimchy)\ **Post date:** [January 31, 2011, 8:07pm UTC](https://discuss.elastic.co/t/hosting-and-securing-elasticsearch/3852/2 "2011-01-31T20:07:42Z")
Heya, There isn't an HTTPS support (yet), but you can proxy ES with HTTPs (which might make more sense). As for suggesting a hosting env, donno..., Have you considered "the cloud" 😉 On Monday, January 31, 2011 at 7:57 PM, Administrator wrote: > I’ve been looking at Elasticsearch and I’m a huge fan of what I’m seeing so far. I’m currently using [Lucene.NET](http://Lucene.NET) on my site ([sf4answers.com](http://sf4answers.com)) to perform searching, but I feel that I’d rather not have to deal with a lot of the overhead that comes with it. > > I was considering SOLR, but Elasticsearch is much, much more appealing to me. > > However, I have a few questions, and I’m hoping I can find some good answers here (and trust me, I’ve tried to look): > > My website is currently running on a shared hosting solution with [ASP.NET](http://ASP.NET) (on [discountasp.net](http://discountasp.net)). To that end, I’d use the .NET client to access Elasticsearch hosted on another domain/ip address. > > That said, are there hosting providers that will let me host a JVM and expose the HTTP endpoint that Elasticsearch requires? If so, could anyone point me to some trusted providers (I will admit to not knowing much about non-Windows hosting platforms). > > Also, how would I secure the operations between the [ASP.NET](http://ASP.NET) host and whatever is hosting the JVM? I was hoping there would be an HTTPS endpoint (with a self issued certificate), but there doesn’t seem to be one. This is a huge concern to me, because I don’t want to just leave my search index out in the wild open to anyone who wants to place entries into it. > > Any insight into this would be greatly appreciated, and thanks in advance. > > - Nick ---
**Author:** ![Administrator\_2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/administrator_2/32/3211_2.png) [@Administrator\_2](https://discuss.elastic.co/u/Administrator_2)\ **Post date:** [January 31, 2011, 8:22pm UTC](https://discuss.elastic.co/t/hosting-and-securing-elasticsearch/3852/3 "2011-01-31T20:22:59Z")
Shay, ``` Thanks for the info. Can you elaborate on proxying ES with HTTPS? How exactly is that achieved? On the surface, to me (someone who admittedly doesn’t know), it seems like it’s just having and HTTPS portal in front of an HTTP portal and you still have to worry about the HTTP portal part (again, I think I’m wildly off base here). As for hosting in the cloud, I see that it would require using both EC2 and S3 from Amazon. Does that solve the security issue? It doesn’t seem that it would. Also, in regards to running in the “cloud”, it would seem that I would need to have the EC2 instance running all the time, which comes to about $62/month if I’ve done the math right for a small on demand instance (or does it have to be another type of instance)? Thanks in advance. - Nick ``` From: Shay Banon [[mailto:shay.banon@elasticsearch.com](mailto:shay.banon@elasticsearch.com)] Sent: Monday, January 31, 2011 3:08 PM To: [users@elasticsearch.com](mailto:users@elasticsearch.com) Subject: Re: Hosting and securing ElasticSearch. Heya, There isn't an HTTPS support (yet), but you can proxy ES with HTTPs (which might make more sense). As for suggesting a hosting env, donno..., Have you considered "the cloud" 😉 On Monday, January 31, 2011 at 7:57 PM, Administrator wrote: ``` I’ve been looking at ElasticSearch and I’m a huge fan of what I’m seeing so far. I’m currently using Lucene.NET on my site (sf4answers.com) to perform searching, but I feel that I’d rather not have to deal with a lot of the overhead that comes with it. I was considering SOLR, but ElasticSearch is much, much more appealing to me. However, I have a few questions, and I’m hoping I can find some good answers here (and trust me, I’ve tried to look): My website is currently running on a shared hosting solution with ASP.NET (on discountasp.net). To that end, I’d use the .NET client to access ElasticSearch hosted on another domain/ip address. That said, are there hosting providers that will let me host a JVM and expose the HTTP endpoint that ElasticSearch requires? If so, could anyone point me to some trusted providers (I will admit to not knowing much about non-Windows hosting platforms). Also, how would I secure the operations between the ASP.NET host and whatever is hosting the JVM? I was hoping there would be an HTTPS endpoint (with a self issued certificate), but there doesn’t seem to be one. This is a huge concern to me, because I don’t want to just leave my search index out in the wild open to anyone who wants to place entries into it. Any insight into this would be greatly appreciated, and thanks in advance. - Nick ``` ---
**Author:** ![Karussell1](https://avatars.discourse-cdn.com/v4/letter/k/50afbb/32.png) [@Karussell1](https://discuss.elastic.co/u/Karussell1)\ **Post date:** [January 31, 2011, 9:54pm UTC](https://discuss.elastic.co/t/hosting-and-securing-elasticsearch/3852/4 "2011-01-31T21:54:01Z")
This question is interesting for me too. Isn't there something where my transportclient could use basic authentication to feed and to query? Would this basic auth make sense for REST API too? Kind Regards, Peter. On 31 Jan., 21:22, "Administrator" [ad...@sf4answers.com](mailto:ad...@sf4answers.com) wrote: > Shay, > > ``` > Thanks for the info. > > Can you elaborate on proxying ES with HTTPS? How exactly is that achieved? On the surface, to me (someone who admittedly doesn’t know), it seems like it’s just having and HTTPS portal in front of an HTTP portal and you still have to worry about the HTTP portal part (again, I think I’m wildly off base here). > > As for hosting in the cloud, I see that it would require using both EC2 and S3 from Amazon. Does that solve the security issue? It doesn’t seem that it would. > > Also, in regards to running in the “cloud”, it would seem that I would need to have the EC2 instance running all the time, which comes to about $62/month if I’ve done the math right for a small on demand instance (or does it have to be another type of instance)? > > Thanks in advance. > > - Nick > > ``` > > From: Shay Banon [[mailto:shay.ba...@elasticsearch.com](mailto:shay.ba...@elasticsearch.com)] > Sent: Monday, January 31, 2011 3:08 PM > To: [us...@elasticsearch.com](mailto:us...@elasticsearch.com) > Subject: Re: Hosting and securing Elasticsearch. > > Heya, > > There isn't an HTTPS support (yet), but you can proxy ES with HTTPs (which might make more sense). As for suggesting a hosting env, donno..., Have you considered "the cloud" 😉 > > On Monday, January 31, 2011 at 7:57 PM, Administrator wrote: > > ``` > I’ve been looking at ElasticSearch and I’m a huge fan of what I’m seeing so far. I’m currently using Lucene.NET on my site (sf4answers.com) to perform searching, but I feel that I’d rather not have to deal with a lot of the overhead that comes with it. > > I was considering SOLR, but ElasticSearch is much, much more appealing to me. > > However, I have a few questions, and I’m hoping I can find some good answers here (and trust me, I’ve tried to look): > > My website is currently running on a shared hosting solution with ASP.NET (on discountasp.net). To that end, I’d use the .NET client to access ElasticSearch hosted on another domain/ip address. > > That said, are there hosting providers that will let me host a JVM and expose the HTTP endpoint that ElasticSearch requires? If so, could anyone point me to some trusted providers (I will admit to not knowing much about non-Windows hosting platforms). > > Also, how would I secure the operations between the ASP.NET host and whatever is hosting the JVM? I was hoping there would be an HTTPS endpoint (with a self issued certificate), but there doesn’t seem to be one. This is a huge concern to me, because I don’t want to just leave my search index out in the wild open to anyone who wants to place entries into it. > > Any insight into this would be greatly appreciated, and thanks in advance. > > - Nick > > ``` ---
**Author:** ![Karussell1](https://avatars.discourse-cdn.com/v4/letter/k/50afbb/32.png) [@Karussell1](https://discuss.elastic.co/u/Karussell1)\ **Post date:** [January 31, 2011, 9:59pm UTC](https://discuss.elastic.co/t/hosting-and-securing-elasticsearch/3852/5 "2011-01-31T21:59:43Z")
One further question: can I disallow requests which do not come from localhost? Or is this the default? On 31 Jan., 22:54, Karussell [tableyourt...@googlemail.com](mailto:tableyourt...@googlemail.com) wrote: > This question is interesting for me too. > > Isn't there something where my transportclient could use basic > authentication to feed and to query? > > Would this basic auth make sense for REST API too? > > Kind Regards, > Peter. > > On 31 Jan., 21:22, "Administrator" [ad...@sf4answers.com](mailto:ad...@sf4answers.com) wrote: > > > Shay, > > > ``` > > Thanks for the info. > > > > ``` > > > ``` > > Can you elaborate on proxying ES with HTTPS? How exactly is that achieved? On the surface, to me (someone who admittedly doesn’t know), it seems like it’s just having and HTTPS portal in front of an HTTP portal and you still have to worry about the HTTP portal part (again, I think I’m wildly off base here). > > > > ``` > > > ``` > > As for hosting in the cloud, I see that it would require using both EC2 and S3 from Amazon. Does that solve the security issue? It doesn’t seem that it would. > > > > ``` > > > ``` > > Also, in regards to running in the “cloud”, it would seem that I would need to have the EC2 instance running all the time, which comes to about $62/month if I’ve done the math right for a small on demand instance (or does it have to be another type of instance)? > > > > ``` > > > ``` > > Thanks in advance. > > > > ``` > > > ``` > > - Nick > > > > ``` > > > From: Shay Banon [[mailto:shay.ba...@elasticsearch.com](mailto:shay.ba...@elasticsearch.com)] > > Sent: Monday, January 31, 2011 3:08 PM > > To: [us...@elasticsearch.com](mailto:us...@elasticsearch.com) > > Subject: Re: Hosting and securing Elasticsearch. > > > Heya, > > > There isn't an HTTPS support (yet), but you can proxy ES with HTTPs (which might make more sense). As for suggesting a hosting env, donno..., Have you considered "the cloud" 😉 > > > On Monday, January 31, 2011 at 7:57 PM, Administrator wrote: > > > ``` > > I’ve been looking at ElasticSearch and I’m a huge fan of what I’m seeing so far. I’m currently using Lucene.NET on my site (sf4answers.com) to perform searching, but I feel that I’d rather not have to deal with a lot of the overhead that comes with it. > > > > ``` > > > ``` > > I was considering SOLR, but ElasticSearch is much, much more appealing to me. > > > > ``` > > > ``` > > However, I have a few questions, and I’m hoping I can find some good answers here (and trust me, I’ve tried to look): > > > > ``` > > > ``` > > My website is currently running on a shared hosting solution with ASP.NET (on discountasp.net). To that end, I’d use the .NET client to access ElasticSearch hosted on another domain/ip address. > > > > ``` > > > ``` > > That said, are there hosting providers that will let me host a JVM and expose the HTTP endpoint that ElasticSearch requires? If so, could anyone point me to some trusted providers (I will admit to not knowing much about non-Windows hosting platforms). > > > > ``` > > > ``` > > Also, how would I secure the operations between the ASP.NET host and whatever is hosting the JVM? I was hoping there would be an HTTPS endpoint (with a self issued certificate), but there doesn’t seem to be one. This is a huge concern to me, because I don’t want to just leave my search index out in the wild open to anyone who wants to place entries into it. > > > > ``` > > > ``` > > Any insight into this would be greatly appreciated, and thanks in advance. > > > > ``` > > > ``` > > - Nick > > > > ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:13am UTC](https://discuss.elastic.co/t/hosting-and-securing-elasticsearch/3852/6 "2017-07-06T04:13:02Z")