How to secure ELK and Filebeat? - ssl

Question

I have a server A on which I installed ELK by following the instructions :
https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elastic-stack-on-ubuntu-18-04
ELK can be accessed from the IP address of my server and I have created Let's Encrypt certificates to secure my domain on Nginx.
server {
listen 80;
listen [::]:80;
server_name monitoring.example.com;
location / {
return 301 https://monitoring.example.com$request_uri;
}
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name monitoring.example.com;
auth_basic "Restricted Access";
auth_basic_user_file /var/www/monitoring-example-com/web/.htpasswd;
ssl_certificate /etc/letsencrypt/live/monitoring.example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/monitoring.example.com/privkey.pem;
include /etc/letsencrypt/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
location / {
proxy_pass http://localhost:5601;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_cache_bypass $http_upgrade;
}
}
I have a server B that I want to monitor and on which I install Filebeat.
How to secure exchanges between ELK and Filebeat ?
Do I need to create an OpenSSL certificate or use the certificates generated with Let's Encrypt for Nginx ?

Answer 1

Do you use logstash in your pipeline or does filebeat output data directly into elasticsearch? Depending on this the answer changes slightly. Other aspects of your cluster setup also matter.
I'll assume that you are outputting data directly into elasticsearch.
The method you described with putting nginx in front of elasticsearch and doing basic authentication is OK for developer/test environment setup with one node cluster. I suspect this is all you want since you are monitoring just one server. If this is all you need you can stop reading.
You should however never use one node setup in production. Elasticsearch is a distributed storage and you should always use at least three nodes in production environments.
Why this matters when it comes to security? In multiple node cluster you have to secure both communication on REST API (default port 9200) and transport layer (the inter-node traffic default port 9300-9400). You may also want to be sure only trusted nodes are connected to the cluster. Nginx is not sufficient for this. One solution is to put the inter-node traffic into full mesh VPN that is setup between the cluster nodes. I recommend using tinc for this. The second is to setup TLS with one of the several security plugins available.
The best is to use both, because you'll probably also want not just encryption but also user management, role separation, audit logging etc.
There are several plugins you can use. The most obvious is to setup X-Pack Security. In this case please refer to the X-Pack documentation. The whole process is described there.
X-Pack is quite expensive. Luckily there are several alternatives the most prominent is searchguard. Community edition has missing a few features like LDAP or Field-level security, but it should be sufficient for most common use-cases. The documentation is not always straight forward, so I recommend doing a few test deployments.
Other alternatives include ReadonlyREST which has both enterprise and free version. Or the newest Open Distro this one is maintaining compatibility only with the OSS version of elasticsearch (it may break the basic licence features).
Edit: 11/18/2019
X-Pack under basic license now offers free basic security features. Pretty much same as searchguard community with addition that you can manage roles and users from Kibana GUI. My personal opinion is that now searchguard community is obsolete because X-Pack provides better features and you have one less dependency in your cluster, which makes updates and administration easier. For commercial use cases searchguard may still be the more sensible option especially for large clusters.

Answer 2

Check the following page which describes how to configure TLS to keep all data private from Filebeat -> Logstash -> Elasticsearch -> Kibana -> your web browser:
TLS for the Elastic Stack: Elasticsearch, Kibana, Beats, and Logstash
Elasticsearch
Basically on Elasticsearch enable transport SSL (in elasticsearch.yml) as follow:
# Enables security.
xpack.security.enabled: True
# Enables transport SSL.
xpack.security.transport.ssl.enabled: True
xpack.security.transport.ssl.keystore.path: "certs/elastic-certificates.p12"
xpack.security.transport.ssl.truststore.path: "certs/elastic-certificates.p12"
xpack.security.transport.ssl.verification_mode: certificate
# Enables SSL via HTTP.
xpack.security.http.ssl.client_authentication: optional
xpack.security.http.ssl.enabled: false
xpack.security.http.ssl.keystore.path: "certs/elastic-certificates.p12"
xpack.security.http.ssl.truststore.path: "certs/elastic-certificates.p12"
For more details, read: Encrypting communications in Elasticsearch.
Filebeat
And enable TLS on Filebeat hosts. Example filebeat.yml:
filebeat.prospectors:
- type: log
paths:
- logstash-tutorial-dataset
output.logstash:
hosts: ["logstash.local:5044"]
ssl.certificate_authorities:
- certs/ca.crt
Read more:
Secure communication with Elasticsearch (to secure communication between Filebeat and Elasticsearch)
Secure communication with Logstash (to secure communication between Filebeat and Logstash)
Logstash
Then you need to enable TLS in Logstash (if in use), example logstash.yml:
node.name: logstash.local
xpack.monitoring.elasticsearch.username: logstash_system
xpack.monitoring.elasticsearch.password: 'CHANGEME'
xpack.monitoring.elasticsearch.url: https://node1.local:9200
xpack.monitoring.elasticsearch.ssl.ca: config/certs/ca.crt
Read more: Secure communication with Logstash.