3 ms·
Not sure what exactly you mean wrt NoAuth DBs, but having a simple on-connect password would be an improvement to all those databases. Things like Elasticsearc
by MichaelGG 10y ago
Not sure what exactly you mean wrt NoAuth DBs, but having a simple on-connect password would be an improvement to all those databases.
Things like Elasticsearch not having even a basic password (esp since it's HTTP so it's trivial) is simply silly. And it's probably not a good idea to support no-auth connections at all - if it's really a hassle, just set the user/pass to the host name.
- pyre 10y ago> Elasticsearch Yea. I found that surprising when it came time to use ElasticSearch for my own purposes. If you want security, you need to setup something between the ElasticSearch server and the clients to moderate.
- jrgnsd 10y agoSetting up nginx to proxy to Elasticsearch with HTTP auth on top is fairly trivial. There's a couple of good articles on the web if you google for it. Also, should you have an Elasticsearch support contract, you get access to the Shield plugin which has extensive access control. But yes, the fact that it is open OOTB is frustrating.
- pyre 10y agoThis is exactly what I do, but the fact that it's wide open and relies on you to use a different (and de-coupled) service for permissions was surprising to me (at the time).