# Security research on XPack settings for ES,LogSta & Kib **URL:** \ **Category:** Elasticsearch\ **Created:** [August 11, 2018, 5:39pm UTC](https://discuss.elastic.co/t/security-research-on-xpack-settings-for-es-logsta-kib/143988 "2018-08-11T17:39:11Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Kaustav\_Gupta](https://avatars.discourse-cdn.com/v4/letter/k/13edae/32.png) [@Kaustav\_Gupta](https://discuss.elastic.co/u/Kaustav_Gupta)\ **Post date:** [August 11, 2018, 5:39pm UTC](https://discuss.elastic.co/t/security-research-on-xpack-settings-for-es-logsta-kib/143988/1 "2018-08-11T17:39:12Z")
I am conducting a research on the recommended XPack parameters and their settings after i install it for version 6.2. I made this list based on the study i have done so far. My objective is to compile a list in order to harden a stack. Additionally looking for the best practices when it comes to the parameter settings for ElasticSearch,Kibana and Logstash.Any help appreciated File Parameter Value elasticsearch.yml xpack.security.enabled "TRUE" xpack.security.hide\_settings \ xpack.security.authc.accept\_default\_password "FALSE" xpack.security.authc.anonymous.\* \ xpack.security.dls\_fls.enabled "TRUE" xpack.security.authc.token.enabled "TRUE" xpack.ssl.client\_authentication REQUIRED xpack.ssl.verification\_mode CERTIFICATE kibana.yml xpack.security.enabled "TRUE" xpack.security.sessionTimeout \ * * * | xpack.graph.enabled | Set to false to disable X-Pack graph features. Configure in both elasticsearch.yml and kibana.yml. | | --- | --- | | xpack.ml.enabled | Set to false to disable X-Pack machine learning features. Configure in both elasticsearch.yml and kibana.yml. | | xpack.monitoring.enabled | Set to false to disable X-Pack monitoring features. Configure in elasticsearch.yml, kibana.yml, and logstash.yml. | | xpack.reporting.enabled | Set to false to disable X-Pack reporting features. Configure in kibana.yml only. | | xpack.security.enabled | Set to false to disable X-Pack security features. Configure in both elasticsearch.yml and kibana.yml. | | xpack.watcher.enabled | Set to false to disable Watcher. Configure in elasticsearch.yml only. | ---
**Author:** ![Yogesh\_Gaikwad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yogesh_gaikwad/32/27025_2.png) [@Yogesh\_Gaikwad](https://discuss.elastic.co/u/Yogesh_Gaikwad)\ **Post date:** [August 13, 2018, 1:24am UTC](https://discuss.elastic.co/t/security-research-on-xpack-settings-for-es-logsta-kib/143988/2 "2018-08-13T01:24:59Z")
Hi Kaustav, Good to see you taking steps to harden the stack. It depends on your environment and what features you are using, what license you have etc. There are a lot of security knobs that you can use to make es stack more secure. We would recommend going through the documentation for more details. Look out for the annotations like `Note:` `Important:` and dig deep further to understand the implications of setting them. For example, you have `xpack.ssl.verification_mode` and the value you have chosen is `certificate`. If you look at the documentation: [TLS Settings - xpack.ssl.verification\_mode](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-settings.html#ssl-tls-settings) , you will see that to be more secure you would want to use `full` instead of `certificate` because certificate does not perform hostname verification. This was just an example and depending on what realm you are using and what environment you are you may need to visit all the settings for that realm/feature etc to understand right settings. Focus more on what you are using in the system and then look through documentation to add more security. There are some configurations which may not be listed under security settings but they are important like `action.destructive_requires_name: true` to eliminate accidental mass deletion of indices and I think a careful analysis of your deployment and requirement is the way to go forward. If you need any help understanding settings we are here. Thanks and Regards, Yogesh Gaikwad ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 10, 2018, 1:35am UTC](https://discuss.elastic.co/t/security-research-on-xpack-settings-for-es-logsta-kib/143988/3 "2018-09-10T01:35:28Z")
Closed on September 10, 2018, 1:35am UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.