4 ms·

I believe Elasticsearch does not have authentication built into the open source version.

btown 7y ago
This is no longer true, but ONLY as of May 2019 in response to pressure from the containerization world. https://www.elastic.co/blog/security-for-elasticsearch-is-now-free https://www.elastic.co/blog/security-for-elasticsearch-is-no... It’s not default insecure like Mongo was - this was far far worse. You couldn’t even prototype in a secure way even if you wanted to, without a massive contract. One of the most frustrating things in software - IMO they deserved to have AWS commoditize their stack.
- xvector 7y ago
  Perhaps it's a controversial opinion, but I feel like it's just flat out unethical to relegate basic security to the paid/enterprise version of your product. Of course it's unethical to use said product to store real user data too, but the road goes both ways.
  - bouke 7y ago
    Just deploy it on your local network. No need to expose it to the internet. Sure, authentication is a nice bonus, but a simple firewall goes a long way.
    - jturpin 7y ago
      I don't get why it ever needs to be on the internet even when it does have authentication. Surely the public/private subnet split is a common practice.
      - kirstenbirgit 7y ago
        The way I see it, password auth for db servers is the last-resort protection mechanism. If you get to the point where it’s what’s protecting your data, you’re already fundamentally screwed.
        CydeWeys 7y ago
        You should definitely have it too, though.
      - CydeWeys 7y ago
        Unless the private subnet is airgapped from the Internet, it's not a good enough separation. Hell, even if it is airgapped, it can still be compromised by viruses on USB sticks and such. You should never be leaving sensitive systems wide open, period, regardless of how secure you might think that network is. Thousands of data breaches have been caused because networks didn't end up being as secure or as separated as hoped for.
    - CydeWeys 7y ago
      Defense in depth is important. Lots of data breaches have been caused because things that should have just been viewable from a local network, weren't, or the network was compromised. Unless you think every single employee is invulnerable to spear-phishing (which is impossible), you should never be leaving anything sensitive wide open on your local network.
- shawnz 7y ago
  The module is now free, but it's not open source, it is licensed under the proprietary Elastic license. The source is available but it is not licensed to be used with anything except the Elastic licensed version of Elasticsearch (not even the Apache licensed version of Elasticsearch) However, Amazon has thankfully released a free and open source security module for Elasticsearch as part of their Open Distro project. It is based on another project called Search Guard. See: https://opendistro.github.io/ https://opendistro.github.io/

This is no longer true, but ONLY as of May 2019 in response to pressure from the containerization world. https://www.elastic.co/blog/security-for-elasticsearch-is-now-free https://www.elastic.co/blog/security-for-elasticsearch-is-no... It’s not default insecure like Mongo was - this was far far worse. You couldn’t even prototype in a secure way even if you wanted to, without a massive contract. One of the most frustrating things in software - IMO they deserved to have AWS commoditize their stack.

xvector 7y ago
Perhaps it's a controversial opinion, but I feel like it's just flat out unethical to relegate basic security to the paid/enterprise version of your product. Of course it's unethical to use said product to store real user data too, but the road goes both ways.
- bouke 7y ago
  Just deploy it on your local network. No need to expose it to the internet. Sure, authentication is a nice bonus, but a simple firewall goes a long way.
  - jturpin 7y ago
    I don't get why it ever needs to be on the internet even when it does have authentication. Surely the public/private subnet split is a common practice.
    - kirstenbirgit 7y ago
      The way I see it, password auth for db servers is the last-resort protection mechanism. If you get to the point where it’s what’s protecting your data, you’re already fundamentally screwed.
      - CydeWeys 7y ago
        You should definitely have it too, though.
    - CydeWeys 7y ago
      Unless the private subnet is airgapped from the Internet, it's not a good enough separation. Hell, even if it is airgapped, it can still be compromised by viruses on USB sticks and such. You should never be leaving sensitive systems wide open, period, regardless of how secure you might think that network is. Thousands of data breaches have been caused because networks didn't end up being as secure or as separated as hoped for.
  - CydeWeys 7y ago
    Defense in depth is important. Lots of data breaches have been caused because things that should have just been viewable from a local network, weren't, or the network was compromised. Unless you think every single employee is invulnerable to spear-phishing (which is impossible), you should never be leaving anything sensitive wide open on your local network.
shawnz 7y ago
The module is now free, but it's not open source, it is licensed under the proprietary Elastic license. The source is available but it is not licensed to be used with anything except the Elastic licensed version of Elasticsearch (not even the Apache licensed version of Elasticsearch) However, Amazon has thankfully released a free and open source security module for Elasticsearch as part of their Open Distro project. It is based on another project called Search Guard. See: https://opendistro.github.io/ https://opendistro.github.io/