You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This section covers how to secure your Elastic environment. Learn how to implement TLS encryption, network security controls, and data protection measures.
78
+
This overview page helps you understand Elastic's security capabilities across different deployment types. You'll find:
79
+
80
+
- Key security features for protecting your Elastic deployment
81
+
- Security capabilities specific to each deployment type
82
+
- Comparison tables showing feature availability and configurability by deployment type
83
+
- Links to detailed implementation guides
79
84
80
85
## Security overview
81
86
82
-
An Elastic implementation comprises many moving parts: {es} nodes forming the cluster, {kib} instances, additional stack components such as Logstash and Beats, and various clients and integrations communicating with your deployment.
87
+
An Elastic implementation comprises many moving parts: {{es}} nodes forming the cluster, {{kib}} instances, additional stack components such as Logstash and Beats, and various clients and integrations communicating with your deployment.
83
88
84
89
To keep your data secured, Elastic offers comprehensive security features that:
85
90
- Prevent unauthorized access to your deployment
86
91
- Encrypt communications between components
87
92
- Protect data at rest
88
93
- Secure sensitive settings and saved objects
89
94
90
-
Security requirements and capabilities vary by deployment. Features may be managed automatically by Elastic, require configuration, or must be fully self-managed. Refer to [Security by deployment type](#security-by-deployment-type) for details.
95
+
:::{note}
96
+
The availability and configurability of security features vary by deployment type. Refer to [Security by deployment type](#security-features-by-deployment-type) for a comparison table.
97
+
:::
91
98
92
-
::::{tip}
93
-
See the [Deployment overview](/deploy-manage/deploy.md) to understand your options for deploying Elastic.
94
-
::::
99
+
## Security topics
95
100
96
-
### Security by deployment type
101
+
The documentation is organized into three main areas.
97
102
98
-
Security features have one of these statuses across deployment types:
103
+
On every page, you'll see deployment type indicators that show which content applies to specific deployment types. Focus on sections tagged with your deployment type and look for subsections specifically addressing your deployment model.
99
104
100
-
| Status | Description |
101
-
|--------|-------------|
102
-
|**Managed**| Handled automatically by Elastic with no user configuration needed |
103
-
|**Configurable**| Built-in feature that needs your configuration (like IP filters or passwords) |
104
-
|**Self-managed**| Infrastructure-level security you implement and maintain |
105
-
|**N/A**| Not available for this deployment type |
105
+
### 1. Secure your orchestrator
106
106
107
-
#### Communication security
107
+
The [security of your orchestrator](security/secure-hosting-environment.md) forms the foundation of your overall security posture. This section covers environment-specific security controls:
-[**Elastic Cloud on Kubernetes**](security/secure-your-eck-installation.md)
113
112
114
-
#### Network security
113
+
:::{note}
114
+
There is no orchestration layer for self-managed deployments because you directly control the host environment. Refer to [](security/manually-configure-security-in-self-managed-cluster.md) to learn more about securing self-managed installations.
[Secure your clients and integrations](security/secure-clients-integrations.md) to ensure secure communication between your applications and Elastic:
136
130
137
-
### Using this documentation
131
+
-[**Client security**](security/httprest-clients-security.md): Best practices for securely connecting applications to {{es}}
132
+
-**Integration security**: Secure configuration for Beats, Logstash, and other integrations
138
133
139
-
Throughout this security documentation, you'll see deployment type indicators that show which content applies to specific deployment types. Each section clearly identifies which deployment types it applies to, and deployment-specific details are separated within each topic.
134
+
## Security features by deployment type
140
135
141
-
To get the most relevant information for your environment, focus on sections tagged with your deployment type and look for subsections specifically addressing your deployment model.
136
+
Security feature availability varies by deployment type, with each feature having one of the following statuses:
142
137
143
-
## Security topics
138
+
|**Status**|**Description**|
139
+
|--------|-------------|
140
+
|**Managed**| Handled automatically by Elastic with no user configuration needed |
141
+
|**Configurable**| Built-in feature that needs your configuration (like IP filters or passwords) |
142
+
|**Self-managed**| Infrastructure-level security you implement and maintain |
143
+
|**N/A**| Not available for this deployment type |
144
144
145
-
This security documentation is organized into four main areas:
145
+
Select your deployment type below to see what's available and how implementation responsibilities are distributed:
146
146
147
-
% TODO: Add links to the sections below
147
+
::::{tab-set}
148
+
:group: deployment-type
148
149
149
-
### 1. Secure your hosting environment
150
+
:::{tab-item} Elastic Cloud Hosted
151
+
:sync: cloud-hosted
150
152
151
-
The security of your hosting environment forms the foundation of your overall security posture. This section covers environment-specific security controls:
Copy file name to clipboardExpand all lines: deploy-manage/security/install-stack-demo-secure.md
+12-6Lines changed: 12 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,10 +1,16 @@
1
-
# Tutorial 2: Securing a self-managed {{stack}} [install-stack-demo-secure]
1
+
---
2
+
applies_to:
3
+
deployment:
4
+
self: ga
5
+
---
2
6
3
-
This tutorial is a follow-on to [Tutorial 1: Installing a self-managed {{stack}}](/deploy-manage/deploy/self-managed.md). The first tutorial describes how to configure a multi-node {{es}} cluster and then set up {{kib}}, followed by {{fleet-server}} and {{agent}}. In a production environment, it’s recommended after completing the {{kib}} setup to proceed directly to this tutorial to configure your SSL certificates. These steps guide you through that process, and then describe how to configure {{fleet-server}} and {{agent}} with the certificates in place.
7
+
# Tutorial: Securing a self-managed {{stack}} [install-stack-demo-secure]
8
+
9
+
This tutorial is a follow-on to [installing a self-managed {{stack}}](/deploy-manage/deploy/self-managed.md) with a multi-node {{es}} cluster, {{kib}}, {{fleet-server}} and {{agent}}. In a production environment, it’s recommended after completing the {{kib}} setup to proceed directly to this tutorial to configure your SSL certificates. These steps guide you through that process, and then describe how to configure {{fleet-server}} and {{agent}} with the certificates in place.
4
10
5
11
**Securing the {{stack}}**
6
12
7
-
Beginning with Elastic 8.0, security is enabled in the {{stack}} by default, meaning that traffic between {{es}} nodes and between {{kib}} and {{es}} is SSL-encrypted. While this is suitable for testing non-production viability of the Elastic platform, most production networks have requirements for the use of trusted CA-signed certificates. These steps demonstrate how to update the out-of-the-box self-signed certificates with your own trusted CA-signed certificates.
13
+
Since {{stack}} 8.0, security is enabled by default, meaning that traffic between {{es}} nodes and between {{kib}} and {{es}} is SSL-encrypted. While this is suitable for testing non-production viability of the Elastic platform, most production networks have requirements for the use of trusted CA-signed certificates. These steps demonstrate how to update the out-of-the-box self-signed certificates with your own trusted CA-signed certificates.
8
14
9
15
For traffic to be encrypted between {{es}} cluster nodes and between {{kib}} and {{es}}, SSL certificates must be created for the transport ({{es}} inter-node communication) and HTTP (for the {{es}} REST API) layers. Similarly, when setting up {{fleet-server}} you’ll generate and configure a new certificate bundle, and then {{elastic-agent}} uses the generated certificates to communicate with both {{fleet-server}} and {{es}}. The process to set things up is as follows:
10
16
@@ -23,7 +29,7 @@ It should take between one and two hours to complete these steps.
23
29
24
30
## Prerequisites and assumptions [install-stack-demo-secure-prereqs]
25
31
26
-
Before starting, you’ll need to have set up an on-premises {{es}} cluster with {{kib}}, following the steps in [Tutorial 1: Installing a self-managed {{stack}}](/deploy-manage/deploy/self-managed.md).
32
+
Before starting, you’ll need to have set up an on-premises {{es}} cluster with {{kib}}, following the steps for [installing a self-managed {{stack}}](/deploy-manage/deploy/self-managed.md).
27
33
28
34
The examples in this guide use RPM packages to install the {{stack}} components on hosts running Red Hat Enterprise Linux 8. The steps for other install methods and operating systems are similar, and can be found in the documentation linked from each section.
29
35
@@ -227,7 +233,7 @@ Now that communication between {{es}} nodes (the transport layer) has been secur
227
233
```
228
234
229
235
2. When prompted, confirm that the settings are correct.
230
-
3. Add the network IP address that clients can use to connect to the first {{es}} node. This is the same value that’s described in Step 2 of [Tutorial 1: Installing a self-managed {{stack}}](/deploy-manage/deploy/self-managed.md), for example `10.128.0.84`:
236
+
3. Add the network IP address that clients can use to connect to the first {{es}} node. For example `10.128.0.84`:
231
237
232
238
```shell
233
239
10.128.0.84
@@ -617,7 +623,7 @@ Now that the transport and HTTP layers are configured with encryption using the
617
623
618
624
Open a web browser to the external IP address of the Kibana host machine: `https://<kibana-host-address>:5601`. Note that the URL should use the `https` and not the `http` protocol.
619
625
620
-
15. Log in using the `elastic` user and password that you configured in Step 1 of [Tutorial 1: Installing a self-managed {{stack}}](/deploy-manage/deploy/self-managed.md).
626
+
15. Log in using the `elastic` user and password that you configured when [installing your self-managed {{stack}}](/deploy-manage/deploy/self-managed.md).
621
627
622
628
Congratulations! You’ve successfully updated the SSL certificates between {{es}} and {{kib}}.
0 commit comments