Continuing the discussion from Query on searchguard without tls : Hi @jkressin , I am using ELK with searchguard in kubernetes environment. I want to use Istio (mtls) that takes care of pod-to-pod TLS communication. So i want to know if there is a way to disable TLS within searchguard and only enab…

You can’t disable TLS on the transport layer. You can disable it only for the REST API. The available TLS configuration options: Configuring TLS | Security for Elasticsearch | Search Guard What is the problem? Doesn’t Istio work with TLS?

@srgbnd , Since we are enabling mTLS on all pods (using Istio), we would want to remove the transport layer tls when SG is enabled, so that communication between all pods would be encrypted by istio’s mTLS.

Also, one more clarification: Transport layer - would mean inter-node communication between elasticsearch nodes using port 9300. REST API - would mean communication between any client (could be logstash, fluentd, curl etc) to elasticsearch and would use the port 9200. Is this understanding correc…

Right, the transport layer is used for internal communication between nodes in a cluster. Transport port range defaults to TCP 9300-9400. REST API in our case is SearchGuard programming interface, for example, Access Control | Security for Elasticsearch | Search Guard . The API port defaults to 9200. …

TLS doesn’t care what data you send or receive, so it can be another TLS session. TLS inside TLS. You can even reuse the same certificate.

Thanks @srgbnd . A follow up question to that: Istio rotates certificates on a regular basis. Once the certificates change, is it sufficient to just run SGadmin to update the new certificates? Or would we need to restart elasticsearch as well?

You don’t need to restart after sgadmin has been used.

Ok, thanks for the information @srgbnd Point noted :slight_smile: I have few queries about using searchguard with istio: If searchguard has been tested with istio in your labs, can you please provide us with any specific configurations required for the setup. With istio in PERMISSIVE mode, it…

[image] shivani.aggarwal2195: Is client certificate and trustore certificates (the arguments --keystore & --truststore) mandatory to run SGadmin ? Not always. Look at sgadmin examples . Also, the sgadmin troubleshooting doc can be useful. [image] shivani.aggarwal2195: …SSL Problem PKIX pa…

Searchguard without tls

Search Guard

srgbnd April 22, 2020, 9:00am 9

@shivani.aggarwal2195 I’m sorry, I was wrong. You must restart if you want to renew a certificate. Please read this thread to find out more Let's Encrypt renewal - restart required?

Topic		Replies	Views
Use sgadmin.sh script without certificates ? Search Guard	7	962	June 1, 2017
Is it possible to install searchguard on ES5 without enabling ssl/tls Search Guard	3	401	May 9, 2017
Disable transport ssl authorization in SearchGuard Search Guard	1	399	June 20, 2017
Search Guard pilot project, need some hints Search Guard	1	429	November 16, 2018
Can searchguard be used for only authorization and authentication and nothing else? Search Guard	1	386	June 22, 2018

Searchguard without tls

Related topics