4 ms·

Elasticsearch started life as a free product and security was a paid addon to that product via the X-Pack, now Elastic Co has made the security stuff free but

Elasticsearch started life as a free product and security was a paid addon to that product via the X-Pack, now Elastic Co has made the security stuff free but people still don't implement it. Elasticsearch is insecure out of the box and it takes extra steps to get it secured, and most people don't do those steps even though its pretty well documented right here: https://www.elastic.co/guide/en/elasticsearch/reference/current/configuring-security.html https://www.elastic.co/guide/en/elasticsearch/reference/curr...

blinkingled 7y ago
Security features in Elastic still require paid subscription. The link you pasted even says that. You can use the xpack features for free on a trial basis but for production use you're required to buy a license.
- farisjarrah 7y ago
  Thank you for the correction. I thought I heard rumblings about their X Pack being free, but I had probably just heard about the trial.
  - blinkingled 7y ago
    You can use the Amazon OpenDistro provided plugins on top of oss ES to enable security features.
- jturpin 7y ago
  This is not true, you can use some xpack security features such as basic auth, client TLS and node-to-node TLS for free. We use basic auth (with Vault integration) at my company using just the basic license. https://www.elastic.co/subscriptions https://www.elastic.co/subscriptions has details on the subscription levels.
  - blinkingled 7y ago
    Thanks, I did not know about basic license. Although if you wanted to use OSS license my point still stands. (Not sure what restrictions the basic license brings so for some the only option might be the OSS license.)
    - jturpin 7y ago
      You're right, and it is only recently that this stuff became free anyways, sometime last year. I think Amazon's OpenDistro stuff put some pressure on them. Even TLS was gated, which was the biggest offense in my opinion!

blinkingled 7y ago

Security features in Elastic still require paid subscription. The link you pasted even says that. You can use the xpack features for free on a trial basis but for production use you're required to buy a license.

farisjarrah 7y ago
Thank you for the correction. I thought I heard rumblings about their X Pack being free, but I had probably just heard about the trial.
- blinkingled 7y ago
  You can use the Amazon OpenDistro provided plugins on top of oss ES to enable security features.
jturpin 7y ago
This is not true, you can use some xpack security features such as basic auth, client TLS and node-to-node TLS for free. We use basic auth (with Vault integration) at my company using just the basic license. https://www.elastic.co/subscriptions https://www.elastic.co/subscriptions has details on the subscription levels.
- blinkingled 7y ago
  Thanks, I did not know about basic license. Although if you wanted to use OSS license my point still stands. (Not sure what restrictions the basic license brings so for some the only option might be the OSS license.)
  - jturpin 7y ago
    You're right, and it is only recently that this stuff became free anyways, sometime last year. I think Amazon's OpenDistro stuff put some pressure on them. Even TLS was gated, which was the biggest offense in my opinion!