You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
^^
- Refocuses the 1st subsection on "orchestrators"
- Left the self-managed section as an outlier and with some notes but I
think currently it's the best place to provide a "360" centered on
self-managed installs
---------
Co-authored-by: Liam Thompson <32779855+leemthompo@users.noreply.github.com>
Copy file name to clipboardexpand all lines: deploy-manage/security.md
+7-6
Original file line number
Diff line number
Diff line change
@@ -100,18 +100,19 @@ The availability and configurability of security features vary by deployment typ
100
100
101
101
The documentation is organized into four main areas.
102
102
103
-
:::{note}
104
-
Throughout the documentation, you'll see deployment type indicators that show which content applies to specific deployment types. Focus on sections tagged with your deployment type and look for subsections specifically addressing your deployment model.
105
-
:::
103
+
On every page, you'll see deployment type indicators that show which content applies to specific deployment types. Focus on sections tagged with your deployment type and look for subsections specifically addressing your deployment model.
106
104
107
-
### 1. Secure your hosting environment
105
+
### 1. Secure your orchestrator
108
106
109
-
The [security of your hosting environment](security/secure-hosting-environment.md) forms the foundation of your overall security posture. This section covers environment-specific security controls:
107
+
The [security of your orchestrator](security/secure-hosting-environment.md) forms the foundation of your overall security posture. This section covers environment-specific security controls:
110
108
111
109
-[**Elastic Cloud Hosted and Serverless**](security/secure-your-elastic-cloud-organization.md)
There is no orchestration layer for self-managed deployments because you directly control the host environment. Refer to [](security/manually-configure-security-in-self-managed-cluster.md) to learn more about securing self-managed installations.
Copy file name to clipboardexpand all lines: deploy-manage/security/install-stack-demo-secure.md
+12-6
Original file line number
Diff line number
Diff line change
@@ -1,10 +1,16 @@
1
-
# Tutorial 2: Securing a self-managed {{stack}} [install-stack-demo-secure]
1
+
---
2
+
applies_to:
3
+
deployment:
4
+
self: ga
5
+
---
2
6
3
-
This tutorial is a follow-on to [Tutorial 1: Installing a self-managed {{stack}}](/deploy-manage/deploy/self-managed.md). The first tutorial describes how to configure a multi-node {{es}} cluster and then set up {{kib}}, followed by {{fleet-server}} and {{agent}}. In a production environment, it’s recommended after completing the {{kib}} setup to proceed directly to this tutorial to configure your SSL certificates. These steps guide you through that process, and then describe how to configure {{fleet-server}} and {{agent}} with the certificates in place.
7
+
# Tutorial: Securing a self-managed {{stack}} [install-stack-demo-secure]
8
+
9
+
This tutorial is a follow-on to [installing a self-managed {{stack}}](/deploy-manage/deploy/self-managed.md) with a multi-node {{es}} cluster, {{kib}}, {{fleet-server}} and {{agent}}. In a production environment, it’s recommended after completing the {{kib}} setup to proceed directly to this tutorial to configure your SSL certificates. These steps guide you through that process, and then describe how to configure {{fleet-server}} and {{agent}} with the certificates in place.
4
10
5
11
**Securing the {{stack}}**
6
12
7
-
Beginning with Elastic 8.0, security is enabled in the {{stack}} by default, meaning that traffic between {{es}} nodes and between {{kib}} and {{es}} is SSL-encrypted. While this is suitable for testing non-production viability of the Elastic platform, most production networks have requirements for the use of trusted CA-signed certificates. These steps demonstrate how to update the out-of-the-box self-signed certificates with your own trusted CA-signed certificates.
13
+
Since {{stack}} 8.0, security is enabled by default, meaning that traffic between {{es}} nodes and between {{kib}} and {{es}} is SSL-encrypted. While this is suitable for testing non-production viability of the Elastic platform, most production networks have requirements for the use of trusted CA-signed certificates. These steps demonstrate how to update the out-of-the-box self-signed certificates with your own trusted CA-signed certificates.
8
14
9
15
For traffic to be encrypted between {{es}} cluster nodes and between {{kib}} and {{es}}, SSL certificates must be created for the transport ({{es}} inter-node communication) and HTTP (for the {{es}} REST API) layers. Similarly, when setting up {{fleet-server}} you’ll generate and configure a new certificate bundle, and then {{elastic-agent}} uses the generated certificates to communicate with both {{fleet-server}} and {{es}}. The process to set things up is as follows:
10
16
@@ -23,7 +29,7 @@ It should take between one and two hours to complete these steps.
23
29
24
30
## Prerequisites and assumptions [install-stack-demo-secure-prereqs]
25
31
26
-
Before starting, you’ll need to have set up an on-premises {{es}} cluster with {{kib}}, following the steps in [Tutorial 1: Installing a self-managed {{stack}}](/deploy-manage/deploy/self-managed.md).
32
+
Before starting, you’ll need to have set up an on-premises {{es}} cluster with {{kib}}, following the steps for [installing a self-managed {{stack}}](/deploy-manage/deploy/self-managed.md).
27
33
28
34
The examples in this guide use RPM packages to install the {{stack}} components on hosts running Red Hat Enterprise Linux 8. The steps for other install methods and operating systems are similar, and can be found in the documentation linked from each section.
29
35
@@ -227,7 +233,7 @@ Now that communication between {{es}} nodes (the transport layer) has been secur
227
233
```
228
234
229
235
2. When prompted, confirm that the settings are correct.
230
-
3. Add the network IP address that clients can use to connect to the first {{es}} node. This is the same value that’s described in Step 2 of [Tutorial 1: Installing a self-managed {{stack}}](/deploy-manage/deploy/self-managed.md), for example `10.128.0.84`:
236
+
3. Add the network IP address that clients can use to connect to the first {{es}} node. For example `10.128.0.84`:
231
237
232
238
```shell
233
239
10.128.0.84
@@ -617,7 +623,7 @@ Now that the transport and HTTP layers are configured with encryption using the
617
623
618
624
Open a web browser to the external IP address of the Kibana host machine: `https://<kibana-host-address>:5601`. Note that the URL should use the `https` and not the `http` protocol.
619
625
620
-
15. Log in using the `elastic` user and password that you configured in Step 1 of [Tutorial 1: Installing a self-managed {{stack}}](/deploy-manage/deploy/self-managed.md).
626
+
15. Log in using the `elastic` user and password that you configured when [installing your self-managed {{stack}}](/deploy-manage/deploy/self-managed.md).
621
627
622
628
Congratulations! You’ve successfully updated the SSL certificates between {{es}} and {{kib}}.
Copy file name to clipboardexpand all lines: deploy-manage/security/manually-configure-security-in-self-managed-cluster.md
+5-19
Original file line number
Diff line number
Diff line change
@@ -9,7 +9,11 @@ mapped_pages:
9
9
10
10
# Manually configure security in a self-managed cluster [manually-configure-security]
11
11
12
-
Security needs vary depending on whether you’re developing locally on your laptop or securing all communications in a production environment. Regardless of where you’re deploying the {{stack}} ("ELK"), running a secure cluster is incredibly important to protect your data. That’s why security is [enabled and configured by default](../deploy/self-managed/installing-elasticsearch.md) in {{es}} 8.0 and later.
12
+
:::{note}
13
+
This page describes important aspects to consider and common end-to-end scenarios for securing your self-managed {{stack}}. For a more granular view of the available security options for your clusters and nodes, refer to [](secure-your-cluster-deployment.md).
14
+
:::
15
+
16
+
Security needs vary depending on whether you’re developing locally on your laptop or securing all communications in a production environment. Regardless of where you’re deploying the {{stack}} ("ELK"), running a secure cluster is incredibly important to protect your data. That’s why security is [enabled and configured by default](../deploy/self-managed/installing-elasticsearch.md) since {{es}} 8.0.
13
17
14
18
If you want to enable security on an existing, unsecured cluster, use your own Certificate Authority (CA), or would rather manually configure security, the following scenarios provide steps for configuring TLS on the transport layer, plus securing HTTPS traffic if you want it.
15
19
@@ -59,24 +63,6 @@ You then configure {{kib}} and Beats to communicate with {{es}} using TLS so tha
59
63
60
64
[Set up basic security plus HTTPS traffic](secure-http-communications.md)
61
65
62
-
## Considerations
63
-
64
-
### TLS certificate management
65
-
66
-
TLS certificates apply security controls to network communications. They encrypt data in transit, verify the identity of connecting parties, and help prevent man-in-the-middle attacks.
67
-
68
-
On **self-managed** installations, you manage certificates for both HTTP and transport layers.
69
-
70
-
### Network security
71
-
72
-
Control which systems can access your Elastic deployment through traffic filtering and network controls:
73
-
74
-
-**IP traffic filtering**: Restrict access based on IP addresses or CIDR ranges.
75
-
76
-
## Next step: secure your deployments and clusters
77
-
78
-
This section covered security principles and options at the environment level. You can take further measures individually for each deployment or cluster that you're running on this environment. Refer to [](secure-your-cluster-deployment.md).
Copy file name to clipboardexpand all lines: deploy-manage/security/secure-hosting-environment.md
+6-7
Original file line number
Diff line number
Diff line change
@@ -4,19 +4,18 @@ applies_to:
4
4
serverless: ga
5
5
---
6
6
7
-
# Secure your hosting environment
7
+
# Secure your orchestrator
8
8
9
-
:::{warning}
10
-
**This page is a work in progress.**
11
-
:::
12
-
13
-
Whether you're running Elastic on {{ecloud}}, through an {{ece}} or {{eck}} orchestrator, or self-managed on your own premises, it is critical that you secure the layer responsible for deploying and hosting your Elastic products.
9
+
Whether you're running Elastic on {{ecloud}} or using an {{ece}} or {{eck}} orchestrator, it is critical that you secure the layer responsible for deploying and hosting your Elastic products.
14
10
15
11
This section covers security measures specific to:
There is no orchestration layer for self-managed installations, but you can find a summary of your security options in [](manually-configure-security-in-self-managed-cluster.md).
19
+
:::
21
20
22
21
Learn how to manage security certificates, configure TLS versions, and implement additional security controls at the environment level.
-[Isolate pods with network policies](/deploy-manage/deploy/cloud-on-k8s/network-policies.md)
16
+
-[Secure the metrics endpoint](/deploy-manage/monitor/orchestrators/k8s-securing-metrics-endpoint.md)
16
17
17
-
TLS certificates apply security controls to network communications. They encrypt data in transit, verify the identity of connecting parties, and help prevent man-in-the-middle attacks.
18
+
Also refer to [](/deploy-manage/deploy/cloud-on-k8s/configure.md) for more information about configuring {{eck}}.
18
19
19
-
With **{{eck}}**, you manage HTTP layer certificates. The transport layer is managed by ECK.
20
+
**Additional deployment-level security settings**
20
21
21
-
## Network security
22
-
23
-
Control which systems can access your Elastic deployment through traffic filtering and network controls:
24
-
25
-
-**IP traffic filtering**: Restrict access based on IP addresses or CIDR ranges.
26
-
27
-
## Next step: secure your deployments and clusters
28
-
29
-
This section covered security principles and options at the environment level. You can take further measures individually for each deployment or cluster that you're running on this environment. Refer to [](secure-your-cluster-deployment.md).
22
+
Additional security settings are available for you to configure individually for each deployment orchestrated using {{eck}}. Refer to [](secure-your-cluster-deployment.md) for more information.
# Secure your Elastic Cloud Enterprise installation[ece-securing-considerations]
10
+
# Secure your Elastic Cloud Enterprise orchestrator[ece-securing-considerations]
11
11
12
-
:::{warning}
13
-
**This page is a work in progress.**
14
-
:::
12
+
This section covers security settings for your {{ece}} orchestrator.
15
13
14
+
**Orchestrator-level security**
16
15
17
-
When securing your {{ece}} installation, consider the following:
16
+
-[**TLS certificates**](secure-your-elastic-cloud-enterprise-installation/manage-security-certificates.md): Apply security controls to network communications. With {{ece}}, you manage proxy certificates for the HTTP layer. The transport layer is managed by ECE.
17
+
-[**Platform role-based access control**](/deploy-manage/users-roles/cloud-enterprise-orchestrator.md): Define the roles of users who have access to your organization and its resources. Note that you can also [manage non-cloud users and roles](/deploy-manage/users-roles/cluster-or-deployment-auth/defining-roles.md).
18
+
-[**Authentication providers**](/deploy-manage/users-roles/cloud-enterprise-orchestrator.md): Integrate with external authentication providers, including Active Directory, LDAP, and SAML.
18
19
19
-
## TLS certificate management
20
20
21
-
TLS certificates apply security controls to network communications. They encrypt data in transit, verify the identity of connecting parties, and help prevent man-in-the-middle attacks.
21
+
**Additional deployment-level security settings**
22
22
23
-
With {{ece}}, you manage proxy certificates for the HTTP layer. The transport layer is managed by ECE. Refer to [](secure-your-elastic-cloud-enterprise-installation/manage-security-certificates.md).
23
+
Additional security settings are available for you to configure individually for each deployment orchestrated using {{ece}}. Refer to [](secure-your-cluster-deployment.md) for more information.
24
24
25
25
26
-
## Users with admin privileges [ece_users_with_admin_privileges]
26
+
## Notes about {{ece}} security
27
+
28
+
### Users with admin privileges [ece_users_with_admin_privileges]
27
29
28
30
In Elastic Cloud Enterprise, every user who can manage your installation through the Cloud UI or the RESTful API is a user with admin privileges. This includes both the `admin` user and the `readonly` user that get created when you install ECE on your first host. Initially, only the `admin` user has the required privileges to make changes to resources on ECE.
29
31
@@ -32,7 +34,7 @@ In Elastic Cloud Enterprise, every user who can manage your installation through
32
34
All Elasticsearch clusters come with X-Pack security features and support role-based access control. To learn more, check [Secure Your Clusters](../users-roles/cluster-or-deployment-auth.md).
33
35
34
36
35
-
## Encryption [ece_encryption]
37
+
###Encryption [ece_encryption]
36
38
37
39
Elastic Cloud Enterprise does not implement encryption at rest out of the box. To ensure encryption at rest for all data managed by Elastic Cloud Enterprise, the hosts running Elastic Cloud Enterprise must be configured with disk-level encryption, such as dm-crypt. In addition, snapshot targets must ensure that data is encrypted at rest as well.
38
40
@@ -43,7 +45,7 @@ Elastic Cloud Enterprise provides full encryption of all network traffic by defa
43
45
TLS is supported when interacting with the [RESTful API of Elastic Cloud Enterprise](https://www.elastic.co/docs/api/doc/cloud-enterprise/) and for the proxy layer that routes user requests to clusters of all versions. Internally, our administrative services also ensure transport-level encryption.
44
46
45
47
46
-
## Attack vectors versus separation of roles [ece-securing-vectors]
48
+
###Attack vectors versus separation of roles [ece-securing-vectors]
47
49
48
50
As covered in [Separation of Roles](../deploy/cloud-enterprise/ece-roles.md), it is important to not mix certain roles in a production environment.
49
51
@@ -53,13 +55,10 @@ Elastic Cloud Enterprise is designed to ensure that an allocator has access only
53
55
54
56
Security comes in layers, and running separate services on separate infrastructure is the last layer of defense, on top of other security features like the JVM security manager, system call filtering, and running nodes in isolated containers with no shared secrets.
55
57
56
-
## Hardware isolation
58
+
59
+
### Hardware isolation
57
60
$$$ece_clusters_share_the_same_resources$$$
58
61
59
62
The Elasticsearch clusters you create on Elastic Cloud Enterprise share the same resources. It is currently not possible to run a specific cluster on entirely dedicated hardware not shared by other clusters.
60
63
61
64
62
-
## Next step: secure your deployments and clusters
63
-
64
-
This section covered security principles and options at the environment level. You can take further measures individually for each deployment or cluster that you're running on this environment. Refer to [](secure-your-cluster-deployment.md).
Copy file name to clipboardexpand all lines: deploy-manage/security/secure-your-elastic-cloud-enterprise-installation/allow-x509-certificates-signed-with-sha-1.md
Copy file name to clipboardexpand all lines: deploy-manage/security/secure-your-elastic-cloud-organization.md
+3-8
Original file line number
Diff line number
Diff line change
@@ -22,14 +22,9 @@ As a managed service, Elastic automatically handles a [number of security featur
22
22
23
23
To reinforce the security of your organization, consider implementing the following measures:
24
24
25
-
-**Network security**. Control which systems can access your Elastic deployments and projects through traffic filtering and network controls:
26
-
-[**IP traffic filtering**](/deploy-manage/security/ip-traffic-filtering.md): Restrict access based on IP addresses or CIDR ranges.
27
-
-[**Private link filters**](/deploy-manage/security/private-link-traffic-filters.md): Secure connectivity through AWS PrivateLink, Azure Private Link, or GCP Private Service Connect.
28
-
-[**Static IPs**](/deploy-manage/security/elastic-cloud-static-ips.md): Use static IP addresses for predictable firewall rules.
29
-
-**Access control**
30
-
-[**Organization-level SSO**](/deploy-manage/users-roles/cloud-organization/configure-saml-authentication.md). Note that for {{ech}} deployments, you can also configure SSO at the [deployment level](/deploy-manage/users-roles/cluster-or-deployment-auth.md).
31
-
-[**Cloud role-based access control**](/deploy-manage/users-roles/cloud-organization/manage-users.md): Define the roles of users who have access to your organization and its resources. Note that for {{ech}} deployments, you can also [manage non-cloud users and roles](/deploy-manage/users-roles/cluster-or-deployment-auth/defining-roles.md).
32
-
-[**Cloud API keys**](/deploy-manage/api-keys/elastic-cloud-api-keys.md): Manage API keys used for programmatic access to [{{ecloud}}](https://www.elastic.co/docs/api/doc/cloud/) and [{{ecloud}} serverless](https://www.elastic.co/docs/api/doc/elastic-cloud-serverless/) APIs.
25
+
-[**Organization-level SSO**](/deploy-manage/users-roles/cloud-organization/configure-saml-authentication.md). Note that for {{ech}} deployments, you can also configure SSO at the [deployment level](/deploy-manage/users-roles/cluster-or-deployment-auth.md).
26
+
-[**Cloud role-based access control**](/deploy-manage/users-roles/cloud-organization/manage-users.md): Define the roles of users who have access to your organization and its resources. Note that for {{ech}} deployments, you can also [manage non-cloud users and roles](/deploy-manage/users-roles/cluster-or-deployment-auth/defining-roles.md).
27
+
-[**Cloud API keys**](/deploy-manage/api-keys/elastic-cloud-api-keys.md): Manage API keys used for programmatic access to [{{ecloud}}](https://www.elastic.co/docs/api/doc/cloud/) and [{{ecloud}} serverless](https://www.elastic.co/docs/api/doc/elastic-cloud-serverless/) APIs.
0 commit comments