Configuring Advanced Security

1. Using Service Accounts

Property	Description	Default Value	Notes
elasticsearch.service_account.name	Name of the service account used by Elasticsearch	`elasticsearch`	Must be unique within the cluster
elasticsearch.service_account.enabled	Enables or disables service account usage	`false`	Requires Elasticsearch 7.10+
kibana.service_account.name	Name of the service account used by Kibana	`kibana`	Must be unique within the cluster
kibana.service_account.enabled	Enables or disables service account usage	`false`	Requires Kibana 7.10+

Example: Enabling Service Accounts in Elasticsearch

elasticsearch:
  service_account:
    name: "elasticsearch"
    enabled: true

Example: Enabling Service Accounts in Kibana

kibana:
  service_account:
    name: "kibana"
    enabled: true

Note: Service accounts must be configured with appropriate permissions in the security index.

Warning: Disabling service accounts will require manual token management.

2. Implementing IP Filtering

Configuration Option	Description	Default Value	Notes
xpack.security.transport.host_filtering.enabled	Enables or disables IP filtering for transport layer communication.	`false`	Set to `true` to enable filtering.
xpack.security.transport.host_filtering.allow	List of IP addresses or CIDR ranges allowed to connect.	`[]`	Must be defined when `enabled` is set to `true`.
xpack.security.transport.host_filtering.deny	List of IP addresses or CIDR ranges denied from connecting.	`[]`	Overrides `allow` if an IP matches both.

Example: Configuring IP Filters in elasticsearch.yml

xpack:
  security:
    transport:
      host_filtering:
        enabled: true
        allow:
          - 192.168.1.0/24
          - 10.0.0.0/8
        deny:
          - 172.16.0.0/12

Note: IP filtering applies to all transport layer communication between nodes in the cluster. Ensure that internal IPs are allowed to maintain cluster functionality.

3. Managing Anonymous Access

Setting	Description	Default	Notes
xpack.security.authc.anonymous.roles	Roles assigned to anonymous users	`["remote_monitoring_collector"]`	Anonymous users get these roles by default
xpack.security.authc.anonymous.username	Username for anonymous users	`anonymous`	Can be customized for better tracking
xpack.security.authc.anonymous.authz_exception	Whether to allow authorization exceptions for anonymous users	`false`	Set to `true` to allow access even when authz fails

Example: Enable Anonymous Access with Custom Role

# elasticsearch.yml
xpack:
  security:
    authc:
      anonymous:
        roles: [ "custom_anonymous_role" ]
        username: "anonymous_user"
        authz_exception: true

Note: Anonymous access should only be enabled in controlled environments where it's safe to do so. It is not recommended for production systems without proper security measures in place.

4. Configuring Realm Chains

Property	Description	Values	Notes
elasticsearch.realm_chains	Defines the sequence of realms to be used for authentication	`realm1, realm2, ...`	Each realm must be defined in `elasticsearch.yml`
elasticsearch.realm_chains.order	Defines the order in which realms are checked for authentication	`1, 2, 3, ...`	Higher numbers are checked later
elasticsearch.realm_chains.enabled	Enables or disables realm chains	`true`, `false`	Default is `true`

Example: Configuring Realm Chains

elasticsearch:
  realm_chains:
    - name: "chain1"
      realms:
        - "ldap"
        - "native"
      order: 1
    - name: "chain2"
      realms:
        - "oauth2"
        - "kerberos"
      order: 2

Note: Realm chains allow for flexible authentication workflows by combining multiple authentication methods in a specific order.

5. Using Encrypted Saved Objects

Encrypted Saved Objects (ESO) in the ELK Stack provide a way to store sensitive data securely within Kibana. This feature ensures that sensitive information, such as API keys or passwords, is encrypted at rest.

Property	Description	Default Value	Notes
xpack.encryptedSavedObjects.enabled	Enables or disables the encrypted saved objects feature.	`false`	Must be set to `true` to enable ESO.
xpack.encryptedSavedObjects.encryptionKey	Encryption key used to encrypt and decrypt saved objects.	`undefined`	Required when ESO is enabled. Should be 32 characters long.
xpack.encryptedSavedObjects.allowlistedEncryptedFields	List of fields that are allowed to be encrypted.	`[]`	Specify fields that can be encrypted, e.g., `["api_key"]`.

Example: Enabling Encrypted Saved Objects

elasticsearch:
  hosts: [ "localhost:9200" ]

xpack:
  encryptedSavedObjects:
    enabled: true
    encryptionKey: "this-is-a-32-character-long-key-for-encryption"

Note: The encryption key must be securely managed and never exposed in configuration files or logs.

Warning: If the encryption key is lost or changed, all encrypted saved objects will become inaccessible.

Key Considerations

Ensure the encryptionKey is securely stored and rotated periodically.
Only fields listed in allowlistedEncryptedFields can be encrypted.
Backups of Kibana configurations should not include unencrypted sensitive data.

6. Implementing Cross-Cluster Security

Feature	Description	Configuration	Notes
xpack.security.cross_cluster.enabled	Enables cross-cluster security	`true`	Required for cross-cluster operations
xpack.security.cross_cluster.roles	Defines roles for cross-cluster access	`admin, user`	Must be defined in each cluster
xpack.security.cross_cluster.remote_hosts	Lists remote cluster hosts	`remote-cluster-1:9200, remote-cluster-2:9200`	Must be accessible from the local cluster

Example: Configuring Cross-Cluster Roles

---
xpack:
  security:
    cross_cluster:
      roles:
        - name: "cross-cluster-admin"
          cluster:
            - "all"
          index:
            - "all"
        - name: "cross-cluster-user"
          cluster:
            - "monitor"
          index:
            - "read"

Note: Ensure that the elasticsearch.yml files in both clusters have matching cross-cluster security configurations.

Warning: Misconfiguring cross-cluster roles can lead to unauthorized access or data loss. Always validate role mappings before deployment.

7. Setting Password Policies

Policy	Description	Default Value	Notes
elasticsearch.password_hashing.algorithm	Algorithm used for hashing passwords	`bcrypt`	Available options: `bcrypt`, `pbkdf2`, `scrypt`
elasticsearch.password_hashing.iterations	Number of iterations for PBKDF2 and SCRYPT algorithms	`10000`	Higher values increase security but impact performance
elasticsearch.password_hashing.salt_length	Length of salt in bytes for hashing algorithms	`32`	Recommended minimum is 16 bytes
elasticsearch.password_hashing.key_length	Length of derived key in bytes	`64`	Should be at least 32 bytes for strong security

Example: Configure Password Hashing

elasticsearch:
  password_hashing:
    algorithm: pbkdf2
    iterations: 20000
    salt_length: 32
    key_length: 64

Note: Changing password hashing settings requires a restart of the Elasticsearch cluster.

Setting	Value	Description
elasticsearch.password_policy.minLength	`8`	Minimum length of a password
elasticsearch.password_policy.maxLength	`128`	Maximum length of a password
elasticsearch.password_policy.requireUppercase	`true`	Require at least one uppercase letter
elasticsearch.password_policy.requireLowercase	`true`	Require at least one lowercase letter
elasticsearch.password_policy.requireDigit	`true`	Require at least one numeric digit
elasticsearch.password_policy.requireSpecialChar	`true`	Require at least one special character
elasticsearch.password_policy.maxConsecutiveChars	`3`	Maximum allowed consecutive identical characters
elasticsearch.password_policy.maxRepeatingChars	`3`	Maximum allowed repeating characters in password
elasticsearch.password_policy.maxSequenceLength	`3`	Maximum allowed sequence length (e.g., abc, 123)

Example: Enforce Strong Passwords

elasticsearch:
  password_policy:
    minLength: 12
    maxLength: 128
    requireUppercase: true
    requireLowercase: true
    requireDigit: true
    requireSpecialChar: true
    maxConsecutiveChars: 2
    maxRepeatingChars: 2
    maxSequenceLength: 3

8. Using Security Domains

Domain	Description	Use Case	Configuration
elasticsearch	Security domain for Elasticsearch	Authentication and authorization for Elasticsearch clusters	`elasticsearch.yml` with `xpack.security.enabled: true`
kibana	Security domain for Kibana	Authentication and authorization for Kibana UI	`kibana.yml` with `xpack.security.enabled: true`
logstash	Security domain for Logstash	Authentication and authorization for Logstash pipelines	`logstash.yml` with `xpack.security.enabled: true`
beats	Security domain for Beats	Authentication and authorization for Beats data collection	`filebeat.yml` with `output.elasticsearch.username: "user"`

Example: Configuring Elasticsearch Security Domain

---
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.http.ssl.enabled: true

Note: Security domains are managed through the xpack.security namespace in each service's configuration file.

Warning: Enabling security features requires a restart of the service to apply changes.

9. Configuring Session Management

Property	Description	Default Value	Notes
elasticsearch.session.timeout	Timeout for inactive sessions in minutes	`30m`	Session will expire after this duration of inactivity
elasticsearch.session.max_inactive_interval	Maximum time a session can remain inactive before being invalidated	`30m`	Can be overridden in security settings
elasticsearch.session.cookie.name	Name of the session cookie used for authentication	`elastic-session`	Customizable to avoid conflicts with other applications
elasticsearch.session.cookie.http_only	Whether the session cookie should be accessible only via HTTP	`true`	Prevents XSS attacks by preventing client-side script access
elasticsearch.session.cookie.secure	Whether the session cookie should be sent over HTTPS only	`false`	Set to `true` in production environments for security
elasticsearch.session.cookie.same_site	SameSite attribute for the session cookie	`lax`	Values: `strict`, `lax`, or `none`

Example: Session Configuration in elasticsearch.yml

elasticsearch:
  session:
    timeout: 60m
    max_inactive_interval: 60m
    cookie:
      name: "myapp-session"
      http_only: true
      secure: true
      same_site: strict

Note: Session management settings are applied at the Elasticsearch level and affect how sessions are handled across all components of the ELK stack.

Warning: Setting elasticsearch.session.cookie.secure to true requires HTTPS to be enabled in your environment.

10. Implementing FIPS 140-2 Mode

ELK Stack supports FIPS 140-2 compliance for cryptographic modules to ensure security standards are met in regulated environments.

Configuration	Description	Value
xpack.security.fips140.mode	Enables or disables FIPS 140-2 mode	`enabled`
xpack.security.fips140.algorithm	Specifies the cryptographic algorithm to use in FIPS mode	`default`

Example: Enabling FIPS 140-2 Mode

xpack:
  security:
    fips140:
      mode: enabled

Note: FIPS 140-2 mode requires compatible JVMs and may impact performance.

11. Using Read-Only Roles

Role Name	Permissions	Description
read_only_user	`cluster:monitor/main`, `indices:monitor/stats`	Allows users to view cluster and index statistics without making changes.
read_only_monitoring	`cluster:monitor/health`, `cluster:monitor/nodes/stats`	Grants read access to cluster health and node statistics.

Example: Assigning Read-Only Role to User

{
  "username": "monitoring_user",
  "roles": ["read_only_user"],
  "enabled": true
}

Note: Read-only roles are useful for monitoring tools or dashboards that need to display data without allowing modifications.

12. Configuring Run As

Property	Description	Default Value	Notes
elasticsearch.run_as	Specifies the user under which Elasticsearch runs	`elasticsearch`	Must be a valid system user with appropriate permissions
logstash.run_as	Specifies the user under which Logstash runs	`logstash`	Should match the user configured in Logstash service files
kibana.run_as	Specifies the user under which Kibana runs	`kibana`	Must have read/write access to Kibana configuration and data directories

Example: Setting Run As User in systemd Service Files

# /etc/systemd/system/elasticsearch.service
[Service]
User=elasticsearch
Group=elasticsearch
ExecStart=/usr/share/elasticsearch/bin/elasticsearch -p /var/run/elasticsearch/elasticsearch.pid

Example: Setting Run As User in Logstash Configuration

# /etc/logstash/logstash.yml
user: logstash
group: logstash

Note: Ensure that the specified users have appropriate file system permissions and are created in the OS before applying these configurations.