Shield your Cluster: Security & Elasticsearch
summary
Shield is a pluggable security layer for Elasticsearch that claims to add authentication, authorization, encryption and auditing without forking the core; about half the work was changing core to support it. Installation is two plugins (license + Shield) and by default every request is rejected until a user is added. It supports IP filtering (cluster-update-settings, rejects before SSL), TLS via Java keystores, chained realms like es-users realm, LDAP and PKI, role-based access control, Logstash/Kibana/Marvel integration, and an audit trail that moves from log file to indexed documents.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 1:37About
- 4:18nginx in front
- 6:40operational overhead
- 11:45IP Filtering
- 17:17Authentication
- 20:39ESusers realm
- 21:59Anonymous access
- 23:28Role Based Access Control
- 24:40Audit Trail
- 25:46Integration
- 27:03Transport Client
- 28:54Logstash
- 29:29Marvel
- 32:19Use-case 4: Ecommerce
- 32:58Next? Simplify SSL configuration
- 36:56Resources
related talks
26mSHIELD: Protecting CF, Services and Applications Through Backups and Restores
35mSecuring software while maintaining usability
34mChoose Your Shield: Evaluating Linux Security Modules for Cloud Na...
20mDefense in Depth: Securing your new Kubernetes cluster from the challenges that lurk within
14mSHIELD: Secure Human-Machine Interaction with Evidential Learning and Dynamic...
16mGraphQLShield: CWE-Aware Defense in Depth for GraphQL APIs in Go-
42mProtect your workloads from DDoS attacks with Shield Advanced
13mEncrypting Your Way to Safety: Data Security in Kubernetes