# Clarification on plain text password **URL:** \ **Category:** Search Guard\ **Created:** [November 1, 2017, 6:56pm UTC](https://forum.search-guard.com/t/clarification-on-plain-text-password/664 "2017-11-01T18:56:50Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![md\_md](https://avatars.discourse-cdn.com/v4/letter/m/45deac/32.png) [@md\_md](https://forum.search-guard.com/u/md_md)\ **Post date:** [November 1, 2017, 6:56pm UTC](https://forum.search-guard.com/t/clarification-on-plain-text-password/664/1 "2017-11-01T18:56:50Z")
In the elasticsearch.yml file, we have the node certificate and its password like below searchguard.ssl.http.keystore\_filepath: generated-certificates/CN=127.0.0.1-keystore.jks searchguard.ssl.http.keystore\_password: asdsadasdsad searchguard.ssl.http.truststore\_filepath: generated-certificates/truststore.jks searchguard.ssl.http.truststore\_password: asdsadasdasd `` If any user gains access to this configuration file , will he able to connect to elastic search as a client by passing the node certificate jks file and password ? Is there any provision to have these password encrypted in the config file ? ---
**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\ **Post date:** [November 1, 2017, 7:22pm UTC](https://forum.search-guard.com/t/clarification-on-plain-text-password/664/2 "2017-11-01T19:22:28Z")
If one gets a node certificate and the keystore password it can be possible to boot a node and connect to the cluster and get the data. So the node certificates and the password need to be kept secure (for example leveraging unix file permissions). To avoid plaintext passwords in config files you can use environment variables to mitigate this. But luckily there is one additional TLS feature which can help here: hostname validation If this is enabled (which is the default) a attacker have to assign the hostname of the certificate to the hostile machine which is hard in a corporate network because you normally need access to the DNS server to do this. > **···** > > > Am 01.11.2017 um 19:56 schrieb md md \: > > > > In the elasticsearch.yml file, we have the node certificate and its password like below > > > > searchguard.ssl.http.keystore\_filepath: generated-certificates/CN=127.0.0.1-keystore.jks > > searchguard.ssl.http.keystore\_password: asdsadasdsad > > searchguard.ssl.http.truststore\_filepath: generated-certificates/truststore.jks > > searchguard.ssl.http.truststore\_password: asdsadasdasd > > > > If any user gains access to this configuration file , will he able to connect to elastic search as a client by passing the node certificate jks file and password ? > > > > Is there any provision to have these password encrypted in the config file ? > > > > -- > > You received this message because you are subscribed to the Google Groups "Search Guard Community Forum" group. > > To unsubscribe from this group and stop receiving emails from it, send an email to search-guard+unsubscribe@googlegroups.com. > > To post to this group, send email to search-guard@googlegroups.com. > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/978d3ffd-5107-42d6-9fa3-4c47f9f5fbd7%40googlegroups.com\](https://groups.google.com/d/msgid/search-guard/978d3ffd-5107-42d6-9fa3-4c47f9f5fbd7%40googlegroups.com%5C). > > For more options, visit [https://groups.google.com/d/optout\](https://groups.google.com/d/optout%5C). ---
**Author:** ![md\_md](https://avatars.discourse-cdn.com/v4/letter/m/45deac/32.png) [@md\_md](https://forum.search-guard.com/u/md_md)\ **Post date:** [November 4, 2017, 6:00am UTC](https://forum.search-guard.com/t/clarification-on-plain-text-password/664/3 "2017-11-04T06:00:14Z")
Thanks for the information > **···** > > On Wednesday, November 1, 2017 at 9:56:50 PM UTC+3, md md wrote: > > > In the elasticsearch.yml file, we have the node certificate and its password like below > > > searchguard.ssl.http.keystore\_filepath: generated-certificates/CN=127.0.0.1-keystore.jks > > searchguard.ssl.http.keystore\_password: asdsadasdsad > > searchguard.ssl.http.truststore\_filepath: generated-certificates/truststore.jks > > searchguard.ssl.http.truststore\_password: asdsadasdasd > > > `` > > > > > > > > > > > > If any user gains access to this configuration file , will he able to connect to elastic search as a client by passing the node certificate jks file and password ? > > > > > > Is there any provision to have these password encrypted in the config file ? > > > > > >