# Securing ElasticSearch Cluster **URL:** \ **Category:** Elasticsearch\ **Created:** [September 22, 2014, 8:12pm UTC](https://discuss.elastic.co/t/securing-elasticsearch-cluster/19923 "2014-09-22T20:12:29Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Pradeep\_Narayan](https://avatars.discourse-cdn.com/v4/letter/p/278dde/32.png) [@Pradeep\_Narayan](https://discuss.elastic.co/u/Pradeep_Narayan)\ **Post date:** [September 22, 2014, 8:12pm UTC](https://discuss.elastic.co/t/securing-elasticsearch-cluster/19923/1 "2014-09-22T20:12:29Z")
Hi - I went over the following article on securing elasticsearch: > **[Scripting and Security | Elastic](https://www.elastic.co/blog/scripting-security)** > > At Elasticsearch, we take security very seriously. We’ve consistently documented that outside access to Elasticsearch clusters be restricted, but with 1.2.x we decided to err on the safe side and chan... I have a question on the specific point below: 1\*. Don’t run Elasticsearch open to the public\* _Elasticsearch is not designed to be a public facing service, it’s intended to be used by your application via the API. By exposing Elasticsearch to the world you run the risk of denial-of-service attacks if a malicious user discovers your production Elasticsearch system. In addition, prior to the 1.2.x release an attacker can use dynamic scripting to perform arbitrary code execution on the machine that Elasticsearch is hosted on if Elasticsearch is open to the public._ _Because of this, it is highly recommended that Elasticsearch be run from behind a firewall, allowing only your development application or Kibana servers to communicate with it. You should block both port 9200 as well as port 9300 from all machines not part of your development environment._ Even if we secure the endpoint with SSL and Basic authentication using Jetty [https://github.com/sonian/elasticsearch-jetty](https://github.com/sonian/elasticsearch-jetty), is it still not fine to expose Elasticsearch? How different is this from any service that is publicly exposed? We have scenarios where we want to share Elasticsearch cluster b/w multiple teams and securing elasticsearch behind Jetty seems like the best option. Please advise. Regards, Pradeep -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/9baa7ea2-cec0-4ea1-b31a-8b024e58f2ab%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/9baa7ea2-cec0-4ea1-b31a-8b024e58f2ab%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![jprante](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jprante/32/44941_2.png) [@jprante](https://discuss.elastic.co/u/jprante)\ **Post date:** [September 22, 2014, 8:46pm UTC](https://discuss.elastic.co/t/securing-elasticsearch-cluster/19923/2 "2014-09-22T20:46:34Z")
Exactly, even with SSL and Basic authentication on port 80/443, you still must not expose port 9200/9300 to the public. You should route all HTTP requests over port 80/443, where you can control the traffic, for your teams sharing ES. Jörg On Mon, Sep 22, 2014 at 10:12 PM, Pradeep Narayan [pradeepnbhat@gmail.com](mailto:pradeepnbhat@gmail.com) wrote: > Hi - I went over the following article on securing elasticsearch: > > [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/blog/scripting-security/) > > I have a question on the specific point below: > > 1\*. Don’t run Elasticsearch open to the public\* > > _Elasticsearch is not designed to be a public facing service, it’s > intended to be used by your application via the API. By exposing > Elasticsearch to the world you run the risk of denial-of-service attacks if > a malicious user discovers your production Elasticsearch system. In > addition, prior to the 1.2.x release an attacker can use dynamic scripting > to perform arbitrary code execution on the machine that Elasticsearch is > hosted on if Elasticsearch is open to the public._ > > _Because of this, it is highly recommended that Elasticsearch be run from > behind a firewall, allowing only your development application or Kibana > servers to communicate with it. You should block both port 9200 as well as > port 9300 from all machines not part of your development environment._ > > Even if we secure the endpoint with SSL and Basic authentication using > Jetty [https://github.com/sonian/elasticsearch-jetty](https://github.com/sonian/elasticsearch-jetty), is it still not > fine to expose Elasticsearch? How different is this from any service that > is publicly exposed? We have scenarios where we want to share Elasticsearch > cluster b/w multiple teams and securing elasticsearch behind Jetty seems > like the best option. Please advise. > > Regards, > > Pradeep > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit > [https://groups.google.com/d/msgid/elasticsearch/9baa7ea2-cec0-4ea1-b31a-8b024e58f2ab%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/9baa7ea2-cec0-4ea1-b31a-8b024e58f2ab%40googlegroups.com) > [https://groups.google.com/d/msgid/elasticsearch/9baa7ea2-cec0-4ea1-b31a-8b024e58f2ab%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/9baa7ea2-cec0-4ea1-b31a-8b024e58f2ab%40googlegroups.com?utm_medium=email&utm_source=footer) > . > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAKdsXoHDsD1%2B0w\_ueXjepVH3ST2yOgcA\_E9XuQ9uQ%3DfPTUhQAA%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAKdsXoHDsD1%2B0w_ueXjepVH3ST2yOgcA_E9XuQ9uQ%3DfPTUhQAA%40mail.gmail.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Pradeep\_Narayan](https://avatars.discourse-cdn.com/v4/letter/p/278dde/32.png) [@Pradeep\_Narayan](https://discuss.elastic.co/u/Pradeep_Narayan)\ **Post date:** [September 22, 2014, 9:56pm UTC](https://discuss.elastic.co/t/securing-elasticsearch-cluster/19923/3 "2014-09-22T21:56:42Z")
Thanks a lot. That means, plugins like Jetty (for Elasticsearch) have limited or no use in real scenarios where we anyway need to hide the elasticsearch port from the external world. Regards, Pradeep On Monday, September 22, 2014 1:46:43 PM UTC-7, Jörg Prante wrote: > Exactly, even with SSL and Basic authentication on port 80/443, you still > must not expose port 9200/9300 to the public. > > You should route all HTTP requests over port 80/443, where you can control > the traffic, for your teams sharing ES. > > Jörg > > On Mon, Sep 22, 2014 at 10:12 PM, Pradeep Narayan \<[pradee...@gmail.com](mailto:pradee...@gmail.com) > \\> wrote: > > > Hi - I went over the following article on securing elasticsearch: > > > > [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/blog/scripting-security/) > > > > I have a question on the specific point below: > > > > 1\*. Don’t run Elasticsearch open to the public\* > > > > _Elasticsearch is not designed to be a public facing service, it’s > > intended to be used by your application via the API. By exposing > > Elasticsearch to the world you run the risk of denial-of-service attacks if > > a malicious user discovers your production Elasticsearch system. In > > addition, prior to the 1.2.x release an attacker can use dynamic scripting > > to perform arbitrary code execution on the machine that Elasticsearch is > > hosted on if Elasticsearch is open to the public._ > > > > _Because of this, it is highly recommended that Elasticsearch be run from > > behind a firewall, allowing only your development application or Kibana > > servers to communicate with it. You should block both port 9200 as well as > > port 9300 from all machines not part of your development environment._ > > > > Even if we secure the endpoint with SSL and Basic authentication using > > Jetty [https://github.com/sonian/elasticsearch-jetty](https://github.com/sonian/elasticsearch-jetty), is it still not > > fine to expose Elasticsearch? How different is this from any service that > > is publicly exposed? We have scenarios where we want to share Elasticsearch > > cluster b/w multiple teams and securing elasticsearch behind Jetty seems > > like the best option. Please advise. > > > > Regards, > > > > Pradeep > > > > -- > > You received this message because you are subscribed to the Google Groups > > "elasticsearch" group. > > To unsubscribe from this group and stop receiving emails from it, send an > > email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com) \. > > To view this discussion on the web visit > > [https://groups.google.com/d/msgid/elasticsearch/9baa7ea2-cec0-4ea1-b31a-8b024e58f2ab%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/9baa7ea2-cec0-4ea1-b31a-8b024e58f2ab%40googlegroups.com) > > [https://groups.google.com/d/msgid/elasticsearch/9baa7ea2-cec0-4ea1-b31a-8b024e58f2ab%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/9baa7ea2-cec0-4ea1-b31a-8b024e58f2ab%40googlegroups.com?utm_medium=email&utm_source=footer) > > . > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/3a9a401d-b2af-4c70-b5e7-76417e0b1b6a%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/3a9a401d-b2af-4c70-b5e7-76417e0b1b6a%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:00am UTC](https://discuss.elastic.co/t/securing-elasticsearch-cluster/19923/4 "2017-07-06T01:00:31Z")