ELK Stack Security: Elasticsearch Authentication & TLS

In this tutorial, you'll learn about ELK Stack Security: Elasticsearch Authentication & TLS. We cover key concepts, practical examples, and best practices to help you understand and apply this topic effectively.

Securing the ELK Stack requires enabling Elasticsearch authentication, configuring role-based access control (RBAC), encrypting traffic with TLS between all components, and securing Kibana with its own authentication layer.

What You'll Learn

In this tutorial, you will enable Elasticsearch security features, create users and roles, configure TLS certificates for encryption, and set up secure communication between Filebeat, Logstash, and Kibana.

Why It Matters

Log data often contains sensitive information -- IP addresses, user IDs, API keys, and error messages revealing internal system details. Without security, anyone who can reach your Elasticsearch port can read, modify, or delete all log data. In production, security is not optional. Regulatory requirements like SOC 2 and GDPR mandate access controls and encryption for log management systems.

Real-World Use

Doda Browser handles user search queries that contain personally identifiable information. The ELK Stack stores these queries in logs for performance analysis. Elasticsearch security ensures only authorized operations team members can access logs. TLS encryption prevents interception of log data as it travels from Filebeat on application servers to the central Logstash and Elasticsearch cluster.

Step 1: Enable Elasticsearch Security

Edit elasticsearch.yml to enable the security features:

xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: /etc/elasticsearch/certs/elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: /etc/elasticsearch/certs/elastic-certificates.p12

Restart Elasticsearch and set built-in user passwords:

bin/elasticsearch-setup-passwords auto

Expected output:

Changed password for user elastic
PASSWORD elastic = 2x9wLp1qR4tY
Changed password for user kibana_system
PASSWORD kibana_system = 8mN3kL7sX2vB

Step 2: Create Roles and Users

Use the Elasticsearch API to create a role that grants read-only access to log indices:

curl -X POST "localhost:9200/_security/role/log_viewer" -H 'Content-Type: application/json' -u elastic:password -d'
{
  "indices": [
    {
      "names": [ "logs-*" ],
      "privileges": [ "read", "view_index_metadata" ]
    }
  ]
}'

Create a user assigned to this role:

curl -X POST "localhost:9200/_security/user/ops_alice" -H 'Content-Type: application/json' -u elastic:password -d'
{
  "password": "securepassword123",
  "roles": [ "log_viewer" ]
}'

Step 3: Configure Kibana Security

Update kibana.yml with the Kibana system user credentials:

elasticsearch.username: kibana_system
elasticsearch.password: "8mN3kL7sX2vB"
elasticsearch.hosts: ["https://localhost:9200"]
elasticsearch.ssl.certificateAuthorities: [ "/etc/kibana/certs/ca.crt" ]

Enable Kibana authentication in the configuration:

xpack.security.enabled: true

Users now log in to Kibana with individual credentials.

Step 4: Secure Logstash with TLS

Logstash connects to Elasticsearch with TLS and authentication:

output {
  elasticsearch {
    hosts => ["https://elasticsearch:9200"]
    user => "logstash_internal"
    password => "${LOGSTASH_PASSWORD}"
    ssl => true
    cacert => "/etc/logstash/certs/ca.crt"
  }
}

Configure the Beats input to require TLS from Filebeat:

input {
  beats {
    port => 5044
    ssl => true
    ssl_certificate_authorities => ["/etc/logstash/certs/ca.crt"]
    ssl_certificate => "/etc/logstash/certs/logstash.crt"
    ssl_key => "/etc/logstash/certs/logstash.key"
    ssl_verify_mode => "force_peer"
  }
}

Step 5: Secure Filebeat to Logstash

Configure Filebeat to connect over TLS:

output.logstash:
  hosts: ["logstash.example.com:5044"]
  ssl.enabled: true
  ssl.certificate_authorities: ["/etc/filebeat/certs/ca.crt"]
  ssl.certificate: "/etc/filebeat/certs/filebeat.crt"]
  ssl.key: "/etc/filebeat/certs/filebeat.key"]

Common Mistakes

1. Using Self-Signed Certificates Without Proper Distribution

Self-signed certificates require every component to trust the CA. Copy the CA certificate to every node and configure each service to use it.

2. Storing Passwords in Configuration Files

Passwords in plain-text config files are a security risk. Use environment variables, the Elasticsearch keystore, or a secrets manager.

3. Forgetting to Secure Internal Communication

TLS between Elasticsearch nodes (transport layer) is as important as external communication. Without it, data can be intercepted inside the cluster.

4. Not Enabling Security on All Components

Securing Elasticsearch but leaving Kibana or Logstash unsecured creates a bypass. Every component must authenticate and encrypt.

5. Overly Permissive Roles

Granting superuser role to all users defeats the purpose of RBAC. Create specific roles with the minimum required privileges.

Practice Questions

1. What is the first step to enable Elasticsearch security? Set xpack.security.enabled: true in elasticsearch.yml and configure TLS for transport and HTTP layers.

2. How do you create a read-only user for log indices? Create a role with read privileges on the log index pattern, then create a user assigned to that role.

3. Why is TLS important between Filebeat and Logstash? It encrypts log data in transit, preventing interception of sensitive information as logs travel across the network.

4. What is the purpose of the Kibana system user? Kibana uses this user to authenticate with Elasticsearch for reading index mappings and performing searches.

5. Challenge: Configure a secure ELK Stack with TLS between all components (Beat to Logstash, Logstash to Elasticsearch, Kibana to Elasticsearch), create a read-only role for developers, and an admin role for operations.

What's Next

Deploy the ELK Stack on Kubernetes using the ECK operator for automated cluster management and scaling.

Built by the developers of Doda Browser, DodaZIP, and Durga Antivirus Pro.