# Ransom attack on Elasticsearch cluster? **URL:** \ **Category:** Elasticsearch\ **Created:** [January 12, 2017, 4:47am UTC](https://discuss.elastic.co/t/ransom-attack-on-elasticsearch-cluster/71310 "2017-01-12T04:47:27Z")\ **Posts on this page:** 6\ **Page:** 2
**Author:** ![nkoothrappahli](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nkoothrappahli/32/31959_2.png) [@nkoothrappahli](https://discuss.elastic.co/u/nkoothrappahli)\ **Post date:** [January 18, 2017, 4:43pm UTC](https://discuss.elastic.co/t/ransom-attack-on-elasticsearch-cluster/71310/22 "2017-01-18T16:43:44Z")
There are also free security solutions like [https://github.com/sscarduzio/elasticsearch-readonlyrest-plugin](https://github.com/sscarduzio/elasticsearch-readonlyrest-plugin) or [https://github.com/floragunncom/search-guard](https://github.com/floragunncom/search-guard) ---
**Author:** ![Olivier\_Oswald](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/olivier_oswald/32/14843_2.png) [@Olivier\_Oswald](https://discuss.elastic.co/u/Olivier_Oswald)\ **Post date:** [January 24, 2017, 8:38am UTC](https://discuss.elastic.co/t/ransom-attack-on-elasticsearch-cluster/71310/23 "2017-01-24T08:38:45Z")
Having security optional is the worst thing elastic managers came up with. We've been driven away and have moved our largest installation back to MongoDB, where it was months ago before we moved to elastic. Luckily its all plug and play, so that one was a matter of hours. The other products will follow up. I suggest you reconsider the x-pack licensing asap. ---
**Author:** ![TheFish](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thefish/32/116225_2.png) [@TheFish](https://discuss.elastic.co/u/TheFish)\ **Post date:** [January 25, 2017, 12:04pm UTC](https://discuss.elastic.co/t/ransom-attack-on-elasticsearch-cluster/71310/24 "2017-01-25T12:04:22Z")
nkoothrappahli You are correct and thanks for linking these here in case others google for this issue. I still hope Elastic can rethink their licensing approach and what parts of their X-Pack product they consider to be something you need to pay for. Especially since it's difficult to argue that adding basic auth is such a tremendous feat of engineering. ---
**Author:** ![maziyar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maziyar/32/18423_2.png) [@maziyar](https://discuss.elastic.co/u/maziyar)\ **Post date:** [January 26, 2017, 4:40pm UTC](https://discuss.elastic.co/t/ransom-attack-on-elasticsearch-cluster/71310/25 "2017-01-26T16:40:13Z")
Alright, I have a huge cluster with billions of documents. It scares me to death every time I see post like this which unfortunately the number of blogs and reports are growing recently. The simplest way is to have cluster in private IP behind reverse\_proxy such as Nginx with a simple authentication. Only expose the Nginx to public and disable DELETE or even PUT/POST over your selected endpoints/users. Even install a simple fail2ban on the machine to ban IP addresses that try to brute force your simple authentication. (this comes integrated with Nginx) Is this so hard to do or this is not good enough that's why nobody even bothers to do it? I get the criticism over x-pack that the Security should be shipped with Elastic Stack. Maybe they do this in the future. Or maybe they won't, but by no means this justifies thousands of MongoDB and Elasticsearch being exposed publicly with the same ports! My 2 cents, use Nginx! It is simple, tons of snippets out there to get you up and running if you've never done reverse proxy. Besides, it is very useful and light weight. May the force be with our Elastic Stack! ---
**Author:** ![Ivan](https://avatars.discourse-cdn.com/v4/letter/i/df788c/32.png) [@Ivan](https://discuss.elastic.co/u/Ivan)\ **Post date:** [January 26, 2017, 6:48pm UTC](https://discuss.elastic.co/t/ransom-attack-on-elasticsearch-cluster/71310/26 "2017-01-26T18:48:47Z")
I used to have an open Elasticsearch instance on the net for anyone to read ([microinstance.com](http://microinstance.com), long gone). All I had in front was a simple Node proxy to prevent anything but GETs ([https://github.com/lukas-vlcek/node.es](https://github.com/lukas-vlcek/node.es)) Fun times. I cannot believe however that others have unintentionally exposed servers. The lack of security was always a big point of contention on the mailing list years ago. There are other security alternatives out there. Besides the cost of x-pack, I still cannot get over how terrible of a name it is. 🙂 Ivan ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 23, 2017, 6:48pm UTC](https://discuss.elastic.co/t/ransom-attack-on-elasticsearch-cluster/71310/27 "2017-02-23T18:48:52Z")
Closed on February 23, 2017, 6:48pm UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed. [Previous page](https://discuss.elastic.co/t/ransom-attack-on-elasticsearch-cluster/71310.md?page=1)