If any user gains access to this configuration file , will he able to connect to elastic search as a client by passing the node certificate jks file and password ?
Is there any provision to have these password encrypted in the config file ?
If one gets a node certificate and the keystore password it can be possible to boot a node and connect to the cluster and get the data.
So the node certificates and the password need to be kept secure (for example leveraging unix file permissions). To avoid plaintext passwords in config files you can
use environment variables to mitigate this.
But luckily there is one additional TLS feature which can help here: hostname validation
If this is enabled (which is the default) a attacker have to assign the hostname of the certificate to the hostile machine which is hard in a corporate network because you normally need access to the DNS server
to do this.
···
Am 01.11.2017 um 19:56 schrieb md md <lives1978@gmail.com>:
In the elasticsearch.yml file, we have the node certificate and its password like below
If any user gains access to this configuration file , will he able to connect to elastic search as a client by passing the node certificate jks file and password ?
Is there any provision to have these password encrypted in the config file ?
If any user gains access to this configuration file , will he able to connect to elastic search as a client by passing the node certificate jks file and password ?
Is there any provision to have these password encrypted in the config file ?