# Securing ELK **URL:** \ **Category:** Elasticsearch\ **Created:** [April 16, 2020, 3:47pm UTC](https://discuss.elastic.co/t/securing-elk/228359 "2020-04-16T15:47:47Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![ManuelF](https://avatars.discourse-cdn.com/v4/letter/m/e99b99/32.png) [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Post date:** [April 16, 2020, 3:47pm UTC](https://discuss.elastic.co/t/securing-elk/228359/1 "2020-04-16T15:47:48Z")
Hi, I am trying to secure my ELK. I have been checking some documentation, tutorials and also topics in [discuss.elastic.co](http://discuss.elastic.co), but everybody shows different steps and settings enabled, so I am confused. \*Note: I am using ELK 6.8.8 with Basic License + running on Debian 10 My goals are: 1- Secure internal ELK communication 2- Secure foreign connections (be able to use https) coming from different beats (PCs and servers out of the ELK network) to ES, Kibana and Logstash 3- Create different users with different level access, so each one can see only specific dashboards Questions: 1- What comes 1st?: a) Enable xpack security in Elasticsearch .yml b) Generate a certificate 2- Should I set my cluster as a CA? 3- Which tool should I use to generate the certificate?: a) /usr/share/elasticsearch/bin/elasticsearch-certutil b) /usr/share/elasticsearch/bin/x-pack/certutil c) If I can use any of the above, then which one would be recommended as the best option? 4- Cert format "p12" vs "PEM". Do I need to select one or the tool being used to generate the cert will determine the output format? 5- Which tool should I use to generate the system passwords (ES, Kibana, etc.)?: a) /usr/share/elasticsearch/bin/elasticsearch-setup-passwords b) /usr/share/elasticsearch/bin/x-pack/setup-passwords 6- Should I use: a) elasticsearch-keystore b) kibana-keystore c) Both 7- Should I use: a) "xpack.security.transport.ssl" ? b) "xpack.security.http.ssl" ? c) "xpack.monitoring" ? c) All? Maybe there are a lot of questions, but I would appreciate and it would be helpful if you could answer them all. Thanks in advance ---
**Author:** ![ManuelF](https://avatars.discourse-cdn.com/v4/letter/m/e99b99/32.png) [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Post date:** [April 17, 2020, 7:51pm UTC](https://discuss.elastic.co/t/securing-elk/228359/3 "2020-04-17T19:51:52Z")
I am trying to follow one or two tutorials (like the following) - [https://www.elastic.co/es/blog/getting-started-with-elasticsearch-security](https://www.elastic.co/es/blog/getting-started-with-elasticsearch-security) - [https://www.elastic.co/guide/en/elasticsearch/reference/6.2/configuring-tls.html#node-certificates](https://www.elastic.co/guide/en/elasticsearch/reference/6.2/configuring-tls.html#node-certificates) I was able to find some of the answers I need, but still gonna need some help. 3- Which tool should I use to generate the certificate?: a) /usr/share/elasticsearch/bin/elasticsearch-certutil b) /usr/share/elasticsearch/bin/x-pack/certutil c) If I can use any of the above, then which one would be recommended as the best option? 5- Which tool should I use to generate the system passwords (ES, Kibana, etc.)?: a) /usr/share/elasticsearch/bin/elasticsearch-setup-passwords b) /usr/share/elasticsearch/bin/x-pack/setup-passwords 6- Should I use: a) elasticsearch-keystore b) kibana-keystore c) Both 7- Should I use: a) "xpack.security.transport.ssl" ? b) "xpack.security.http.ssl" ? c) "xpack.monitoring" ? c) All/other? Also I am facing the following issue when trying to enable xpack: I am able to: - Generate a certificate - Enable xpack in ES config file by adding these lines (not sure if I need all of them) Here comes the issue: After restart ES service and attempt to generate the passwords, I get this error: ```auto user1@testserver:~$ sudo /usr/share/elasticsearch/bin/elasticsearch-setup-passwords auto warning: Falling back to java on path. This behavior is deprecated. Specify JAVA_HOME Connection failure to: https://192.168.0.179:9200/_xpack/security/_authenticate?pretty failed: Connection refused (Connection refused) ERROR: Failed to connect to elasticsearch at https://192.168.0.179:9200/_xpack/security/_authenticate?pretty. Is the URL correct and elasticsearch running? user1@testserver:~$ ``` Also the ES log output can be found here [https://pastebin.com/H302an8H](https://pastebin.com/H302an8H) Just for the records, I did not installed any additional Java for ELK, so it must be using the bundled version. I don't know if I am missing a step or there is something wrong with my ELK Thanks ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 15, 2020, 7:51pm UTC](https://discuss.elastic.co/t/securing-elk/228359/4 "2020-05-15T19:51:58Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.