4 ms·
I have never setup Elasticsearch or Kibana mysslf, but is the setup process secure-by-default? i.e. generate a random password or key by default, and then you h
by k_sze 7y ago
I have never setup Elasticsearch or Kibana mysslf, but is the setup process secure-by-default? i.e. generate a random password or key by default, and then you have to go out of your way to unsecure it?
- kzrdude 7y agoI hope it has changed since I set up elasticsearch v5, which supports neither authentication nor TLS without plugins.
- Jonnerz 7y agoNope it's very much still unsecure by default.
- k_sze 7y agoThen aren’t those services/products partly to blame? There should be very few legitimate reasons to leave those things unsecured, no?
- tastroder 7y agoI'd be hard pressed for blaming them tbh. I think the reasoning is that these are internal services you should put behind whatever measures you have put in place anyway and not expose otherwise. While the previous comment is technically correct about being unsecure by default, they also don't listen to the outside world (see [1], network.host) by default. I've always thought that makes sense for elastic tbh, security isn't their core business so by leaving that part up to you they avoid screwing it up. [1] https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-network.html https://www.elastic.co/guide/en/elasticsearch/reference/curr...
- SmellyGeekBoy 7y agoThe same could be said about MySQL - but even that switched to entering a root password and disallowing root login, as well as not binding to any network interfaces until explicitly configured to do so. Of course this can all be overridden with simple config changes but it's relatively "secure by default". (just to pick an example I'm familiar with).