[search guard learning] Someone speaks plaintext instead of ssl, will close the channel

Search Guard
1

Hi , everyone:

pls, help me to solve this problem.

Someone speaks plaintext instead of ssl, will close the channel

elasticsearch.yml



2

I think the error message is very clear: You have enabled HTTPS, but you, or another plugin or application like Kibana is trying to access ES via HTTP. If you enable HTTPS on the REST layer, HTTP is not allowed, only HTTPS.

···

On Sunday, 16 October 2016 10:57:16 UTC+2, majinzhou007@gmail.com wrote:

Hi , everyone:

pls, help me to solve this problem.

Someone speaks plaintext instead of ssl, will close the channel

elasticsearch.yml



3

But how do you know who is this other plugin or application?

בתאריך יום רביעי, 26 באוקטובר 2016 בשעה 15:58:48 UTC+3, מאת Search Guard:

···

I think the error message is very clear: You have enabled HTTPS, but you, or another plugin or application like Kibana is trying to access ES via HTTP. If you enable HTTPS on the REST layer, HTTP is not allowed, only HTTPS.

On Sunday, 16 October 2016 10:57:16 UTC+2, majinz...@gmail.com wrote:

Hi , everyone:

pls, help me to solve this problem.

Someone speaks plaintext instead of ssl, will close the channel

elasticsearch.yml



4

Hi,
there should be (depending on the log level?), a line like:

  • io.netty.handler.codec.DecoderException:
    io.netty.handler.ssl.NotSslRecordException: not an SSL/TLS record: 474554202f20485454502f312e310d0a4163636570742d456e636f64696e673a20677a69703b713d312e302c6465666c6174653b713d302e362c6964656e746974793b713d302e330d0a4163636570743a202a2f2a0d0a557365722d4167656e743a20527562790d0a436f6e6e656374696f6e3a20636c6f73650d0a486f73743a206c6f63616c686f73743a393230300d0a0d0a*
    in the logfile.

if
you decode the hex value, it should show a HTTP request, which might indicate where the request originates. (User-Agent, URL,…)

regards,
0x2a

···

On Wednesday, June 21, 2017 at 6:23:07 PM UTC+2, HilaF wrote:

But how do you know who is this other plugin or application?

5

Depending on your version, you should also see the IP/Port of the application that tries to access via HTTP:

Someone (/127.0.0.1:57713) speaks http plaintext instead of ssl, will close the channel

···

On Wednesday, June 21, 2017 at 6:23:07 PM UTC+2, HilaF wrote:

But how do you know who is this other plugin or application?

בתאריך יום רביעי, 26 באוקטובר 2016 בשעה 15:58:48 UTC+3, מאת Search Guard:

I think the error message is very clear: You have enabled HTTPS, but you, or another plugin or application like Kibana is trying to access ES via HTTP. If you enable HTTPS on the REST layer, HTTP is not allowed, only HTTPS.

On Sunday, 16 October 2016 10:57:16 UTC+2, majinz...@gmail.com wrote:

Hi , everyone:

pls, help me to solve this problem.

Someone speaks plaintext instead of ssl, will close the channel

elasticsearch.yml