4 ms·
Has Elasticsearch done anything to fix its ridiculously bad lack of access control? People are fucking stupid, and expecting them not to fuck this up is a big
by tomc1985 5y ago
Has Elasticsearch done anything to fix its ridiculously bad lack of access control?
People are fucking stupid, and expecting them not to fuck this up is a big ask. Too big, in fact.
Secure by default or GTFO
- kieselguhr_kid 5y agoI think it's reasonable to expect the FBI to not expose this. I'm with you on Elasticsearch being too insecure but you're talking about secret government info. If they put that on the open internet that's a serious failure on their part and they'd have fucked it up with another tool if they weren't fucking it up with ES.
- clipradiowallet 5y agoElasticsearch has nothing to fix - the product does precisely what the config tells it to. Maintainers of various distros ES packages are largely responsible for any [mis]configuration there. If you'd like to read how you can secure ES, go do that: https://www.elastic.co/what-is/open-x-pack https://www.elastic.co/what-is/open-x-pack PS: x-pack is the piece that adds authorization/authentication to ES.
- altdataseller 5y agoYou can setup username and pass auth in newer versions of Elastic without paying for xpack (I think at version 6 or up?)
- clipradiowallet 5y agoX-pack is free now, they don't make you license it anymore. I wasn't aware of how to setup username/pass without it though (other than something like an nginx proxy in front of 9200/tcp with basic auth)