Security in elasticsearch

Elastic Stack Elasticsearch
1

Hello everyone, such a question, I recently set up elasticsearch 7.17, when I created certificates, I caught myself thinking that I didn’t fully understand the meaning, I hope you can help me.

  1. as I understand it, there are three degrees of protection, this is protection between the nodes themselves in the cluster, then there is protection when third-party clients contact (which, as I understand it, kibana is), and the third is protection when accessing kibana through a browser, is it correct I got it?
  2. When creating a config for connecting logstash to a secure elasticsearch cluster, the certificate that was created for kibana is indicated elasticsearch-ca.pem so the question is, why do we add a kibana certificate, and do not create, for example, 2 separate certificates for logstash?
2
  1. as I understand it, there are three degrees of protection, this is protection between the nodes themselves in the cluster, then there is protection when third-party clients contact (which, as I understand it, kibana is), and the third is protection when accessing kibana through a browser, is it correct I got it?

Yes, your understanding is absolutely right.

  1. When creating a config for connecting logstash to a secure elasticsearch cluster, the certificate that was created for kibana is indicated elasticsearch-ca.pem so the question is, why do we add a kibana certificate, and do not create, for example, 2 separate certificates for logstash?

This point is not very clear for me.

But with what I understood, when you connect with elasticsearch, in the logstash config file output, you need to provide the certificate of elasticsearch as it authenticates with the certificate inside elasticsearch and then the handshake happens and the data will get transmitted to elasticsearch.

Try explaining your 2nd point in more detail so that we can guide further.

Thanks.

3

Hi, on the 2nd point, it turns out elasticsearch-ca.pem for kibana is used as a CA public key (ca.crt) so that applications trust elasticsearch?

4

ca.crt or ca.pem is the certificate authority/signing authority using which the certificates try to authenticate eachother for authentication.

5

Now it’s clear, between ca.pem and ca.crt you can set equal

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.