# Secure elasticstack **URL:** \ **Category:** Elasticsearch\ **Created:** [July 27, 2020, 1:32pm UTC](https://discuss.elastic.co/t/secure-elasticstack/242752 "2020-07-27T13:32:35Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![elk6](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elk6/32/72282_2.png) [@elk6](https://discuss.elastic.co/u/elk6)\ **Post date:** [July 27, 2020, 1:32pm UTC](https://discuss.elastic.co/t/secure-elasticstack/242752/1 "2020-07-27T13:32:35Z")
I have a small cluster that sits on one machine which pulls data from about 5 servers. Now, I was asked to secure the connection and set up a user for when entering Kibana. I read the latest documentation and it seems like this requires a paid subscription but some online sources says it's not anymore. Is it possible to encrypt communications and set a login user with the opensource version? If so, may I ask how? Huge thanks ahead! ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 27, 2020, 1:40pm UTC](https://discuss.elastic.co/t/secure-elasticstack/242752/2 "2020-07-27T13:40:51Z")
Which version are you using? ---
**Author:** ![elk6](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elk6/32/72282_2.png) [@elk6](https://discuss.elastic.co/u/elk6)\ **Post date:** [July 27, 2020, 1:41pm UTC](https://discuss.elastic.co/t/secure-elasticstack/242752/3 "2020-07-27T13:41:45Z")
Thanks for the response, Latest 7.8.0 ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 27, 2020, 1:43pm UTC](https://discuss.elastic.co/t/secure-elasticstack/242752/4 "2020-07-27T13:43:16Z")
Security is free if you use the default distribution with the free basic license. The OSS distribution does not contain any security. ---
**Author:** ![elk6](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elk6/32/72282_2.png) [@elk6](https://discuss.elastic.co/u/elk6)\ **Post date:** [July 27, 2020, 1:44pm UTC](https://discuss.elastic.co/t/secure-elasticstack/242752/5 "2020-07-27T13:44:45Z")
Can I ask you to direct me to the documentation or guide that covers that? Thanks ahead. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [July 27, 2020, 10:36pm UTC](https://discuss.elastic.co/t/secure-elasticstack/242752/6 "2020-07-27T22:36:15Z")
[Some indexes have been deleted, now I see indexes called meow?](https://discuss.elastic.co/t/some-indexes-have-been-deleted-now-i-see-indexes-called-meow/242731/3) has some details on that. ---
**Author:** ![elk6](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elk6/32/72282_2.png) [@elk6](https://discuss.elastic.co/u/elk6)\ **Post date:** [July 28, 2020, 8:10am UTC](https://discuss.elastic.co/t/secure-elasticstack/242752/7 "2020-07-28T08:10:12Z")
Thanks for the response, Using [this guide](https://www.elastic.co/guide/en/elasticsearch/reference/current/configuring-security.html), I've created the two certificates (with password): ``` bin/elasticsearch-certutil ca bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12 ``` made sure that permissions are right: ``` # ll /usr/share/elasticsearch/ total 576 **-rwxrwxrwx 1 root root 3451 Jul 27 19:00 elastic-certificates.p12** **-rwxrwxrwx 1 root root 2527 Jul 27 18:57 elastic-stack-ca.p12** (There are other files but I deleted the lines so it won't be cluttered) ``` And since I only have one instance of elasticsearch, I've added the following at the bottom of elasticsearch.yml: ``` xpack.security.enabled: true xpack.security.transport.ssl.enabled: true xpack.security.transport.ssl.verification_mode: certificate xpack.security.transport.ssl.keystore.path: elastic-certificates.p12 xpack.security.transport.ssl.truststore.path: elastic-certificates.p12 ``` As the last step in the guide, I've added the passwords using this command: ``` bin/elasticsearch-keystore add xpack.security.transport.ssl.keystore.secure_password bin/elasticsearch-keystore add xpack.security.transport.ssl.truststore.secure_password ``` But when I restart elasticsearch it fails: ``` [root@SERVER-150 elasticsearch]# systemctl restart elasticsearch Job for elasticsearch.service failed because the control process exited with error code. See "systemctl status elasticsearch.service" and "journalctl -xe" for details. [root@SERVER-150 elasticsearch]# systemctl status elasticsearch.service -l ● elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; enabled; vendor preset: disabled) Active: failed (Result: exit-code) since Tue 2020-07-28 08:05:01 UTC; 11s ago Docs: https://www.elastic.co Process: 19265 ExecStart=/usr/share/elasticsearch/bin/systemd-entrypoint -p ${PID_DIR}/elasticsearch.pid --quiet (code=exited, status=1/FAILURE) Main PID: 19265 (code=exited, status=1/FAILURE) Jul 28 08:05:01 SERVER-150 systemd-entrypoint[19265]: at java.base/java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:578) Jul 28 08:05:01 SERVER-150 systemd-entrypoint[19265]: at org.elasticsearch.node.Node.(Node.java:488) Jul 28 08:05:01 SERVER-150 systemd-entrypoint[19265]: at org.elasticsearch.node.Node.(Node.java:266) Jul 28 08:05:01 SERVER-150 systemd-entrypoint[19265]: at org.elasticsearch.bootstrap.Bootstrap$5.(Bootstrap.java:227) Jul 28 08:05:01 SERVER-150 systemd-entrypoint[19265]: <<>> Jul 28 08:05:01 SERVER-150 systemd-entrypoint[19265]: For complete error details, refer to the log at /var/log/elasticsearch/testcluster.log Jul 28 08:05:01 SERVER-150 systemd[1]: elasticsearch.service: main process exited, code=exited, status=1/FAILURE Jul 28 08:05:01 SERVER-150 systemd[1]: Failed to start Elasticsearch. Jul 28 08:05:01 SERVER-150 systemd[1]: Unit elasticsearch.service entered failed state. Jul 28 08:05:01 SERVER-150 systemd[1]: elasticsearch.service failed. ``` ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [July 28, 2020, 8:22am UTC](https://discuss.elastic.co/t/secure-elasticstack/242752/8 "2020-07-28T08:22:32Z")
> [@elk6](#): > > `For complete error details, refer to the log at /var/log/elasticsearch/testcluster.log` What's in there? ---
**Author:** ![elk6](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elk6/32/72282_2.png) [@elk6](https://discuss.elastic.co/u/elk6)\ **Post date:** [July 28, 2020, 8:28am UTC](https://discuss.elastic.co/t/secure-elasticstack/242752/9 "2020-07-28T08:28:46Z")
Thanks for the response, I've looked at it but couldnt make much sense of it: > **[\[root@SERVER-150 john\]# tail -150 /var/log/elasticsearch/testcluster.log\[2020-...](https://pastebin.com/RzDPYiJt)** > > Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [July 28, 2020, 8:29am UTC](https://discuss.elastic.co/t/secure-elasticstack/242752/10 "2020-07-28T08:29:28Z")
```auto Caused by: java.nio.file.NoSuchFileException: /etc/elasticsearch/elastic-certificates.p12 ``` Does that exist? ---
**Author:** ![elk6](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elk6/32/72282_2.png) [@elk6](https://discuss.elastic.co/u/elk6)\ **Post date:** [July 28, 2020, 12:10pm UTC](https://discuss.elastic.co/t/secure-elasticstack/242752/12 "2020-07-28T12:10:23Z")
Thanks for the response, it worked! I was able to move on and now having some trouble encrypting filebeat to logstash (It's the last step). According to the ["secure filebeat to logstash" page](https://www.elastic.co/guide/en/beats/filebeat/7.8/configuring-ssl-logstash.html), I need .crt and .key configured on both ends. Problem is, that so far only `elastic-certificates.p12` and `elastic-stack-ca.p12` as in [this page](https://www.elastic.co/guide/en/elasticsearch/reference/7.8/configuring-tls.html#node-certificates). Do I have to use these to file as if they're .crt and .key? Do I need to create additional files? Thanks ahead! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 25, 2020, 12:10pm UTC](https://discuss.elastic.co/t/secure-elasticstack/242752/13 "2020-08-25T12:10:34Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.