What happens if our license expires before our new one arrives?

Search Guard
1

Search Guard version 6.25.6

My organisation has ordered a new license. We have been chasing actually getting it. There are now only 2 working days left before the license expires over the weekend. I am assuming the consequence of the license expiring is that our cluster breaks during the weekend. Which would be bad. If the new license doesn’t appear before end of the last working day before it expires, is there anything we can do as a temporary measure to keep the cluster working?

I’ve looked for a way to generate a trial license to load but only found the info about generating demo stuff, I couldn’t see how to get just a license to load in to an existing cluster and I don’t know if that would even work.

2

We have the same problem. We have started renewing our license about a 2 months in advance because the reseller takes forever to get the license to us.

**For the record, we have had such trouble with resellers getting us keys we already paid for that we have resorted to the below. I believe it is 100% the resellers fault and not SearchGuard.
***This applies to older versions, I have no idea if it has changed or still works in the newer versions:

Kibana will throw a nag error about being unlicensed but nothing will break.

It is possible to revert to a trial license. Export config → delete searchguard index → delete license out of config → import config.

  #backup config
  rm -rf /etc/searchguard/sg_config/temp
  mkdir /etc/searchguard/sg_config/temp
  /usr/share/elasticsearch/plugins/search-guard-7/tools/sgadmin.sh --retrieve -cd /etc/searchguard/sg_config/temp -icl -nhnv -cacert /etc/searchguard/sg_config/root-ca.pem -cert /etc/searchguard/sg_config/admin.pem -key /etc/searchguard/sg_config/admin.key -keypass password1234
  
  #delete config index
  /usr/share/elasticsearch/plugins/search-guard-7/tools/sgadmin.sh -dci -icl -nhnv -cacert /etc/searchguard/sg_config/root-ca.pem -cert /etc/searchguard/sg_config/admin.pem -key /etc/searchguard/sg_config/admin.key -keypass password1234
  
  #rename backup config files
  mv /etc/searchguard/sg_config/temp/sg_action_groups_2* /etc/searchguard/sg_config/temp/sg_action_groups.yml
  mv /etc/searchguard/sg_config/temp/sg_blocks_2* /etc/searchguard/sg_config/temp/sg_blocks.yml
  mv /etc/searchguard/sg_config/temp/sg_config_2* /etc/searchguard/sg_config/temp/sg_config.yml
  mv /etc/searchguard/sg_config/temp/sg_internal_users_2* /etc/searchguard/sg_config/temp/sg_internal_users.yml
  mv /etc/searchguard/sg_config/temp/sg_roles_mapping_2* /etc/searchguard/sg_config/temp/sg_roles_mapping.yml
  mv /etc/searchguard/sg_config/temp/sg_roles_2* /etc/searchguard/sg_config/temp/sg_roles.yml
  mv /etc/searchguard/sg_config/temp/sg_tenants_2* /etc/searchguard/sg_config/temp/sg_tenants.yml
  
  # delete license from file
  cp /etc/searchguard/sg_config/temp/sg_config.yml /etc/searchguard/sg_config/temp/sg_config_with_license.bk
  sed -i 's/    license:.*/    license: ""/g' /etc/searchguard/sg_config/temp/sg_config.yml
  
  #import config and create searchguard index
  /usr/share/elasticsearch/plugins/search-guard-7/tools/sgadmin.sh -cd /etc/searchguard/sg_config/temp -icl -nhnv -cacert /etc/searchguard/sg_config/root-ca.pem -cert /etc/searchguard/sg_config/admin.pem -key /etc/searchguard/sg_config/admin.key -keypass password1234
3

The new license has arrived with two working hours to spare.

4

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.