Encrypt Cluster and Client Elasticsearch Networks

You work as a system administrator and are in charge of a 6-node Elasticsearch cluster that has been used for ad-hoc, non-sensitive data analysis. However, your Business Intelligence office would like to start using this cluster to analyze some sensitive customer data, so they need you to secure the Elasticsearch cluster to meet the following data security requirements:

• Cluster network encryption
• Client network encryption
• User authentication

To do this, you will need to create a certificate authority (CA) protected by the password elastic_ca using the elasticsearch-certutil tool, and then use the CA to create and sign node certificates for each Elasticsearch node. The node certificates should also be password-protected and stored in the /home/elastic/elasticsearch/config/certs directory.

To support full verification mode, the node certificates should be generated as follows:

+----------+--------------------------+------------+----------+------------------+
| Name     | DNS                      | IP         | Filename | Password         |
+----------+--------------------------+------------+----------+------------------+
| master-1 | ip-10-1-101.ec2.internal | 10.0.1.101 | master-1 | elastic_master_1 |
+----------+--------------------------+------------+----------+------------------+
| master-2 | ip-10-1-102.ec2.internal | 10.0.1.102 | master-2 | elastic_master_2 |
+----------+--------------------------+------------+----------+------------------+
| master-3 | ip-10-1-103.ec2.internal | 10.0.1.103 | master-3 | elastic_master_3 |
+----------+--------------------------+------------+----------+------------------+
| data-1   | ip-10-1-104.ec2.internal | 10.0.1.104 | data-1   | elastic_data_1   |
+----------+--------------------------+------------+----------+------------------+
| data-2   | ip-10-1-105.ec2.internal | 10.0.1.105 | data-2   | elastic_data_2   |
+----------+--------------------------+------------+----------+------------------+
| data-3   | ip-10-1-106.ec2.internal | 10.0.1.106 | data-3   | elastic_data_3   |
+----------+--------------------------+------------+----------+------------------+

The built-in user passwords for Elasticsearch will need to be set after enabling transport network encryption using the elasticsearch-setup-passwords tool. For this, set each built-in user's password as follows:

+------------------------+-------------------------------+
| User                   | Password                      |
+------------------------+-------------------------------+
| elastic                | la_elastic_409                |
+------------------------+-------------------------------+
| apm_system             | la_apm_system_409             |
+------------------------+-------------------------------+
| kibana                 | la_kibana_409                 |
+------------------------+-------------------------------+
| logstash_system        | la_logstash_system_409        |
+------------------------+-------------------------------+
| beats_system           | la_beats_system_409           |
+------------------------+-------------------------------+
| remote_monitoring_user | la_remote_monitoring_user_409 |
+------------------------+-------------------------------+

Important: Don’t forget to add the password you used to protect the certificate package to the local Elasticsearch keystore on each node as both the truststore and keystore secure password.