Best Practices Securing ElasticSearch and Couchbase

Question

I've been experimenting with trying to secure a Elasticsearch cluster with basic auth and TLS.

I've successfully been able to do that using Search-Guard. The problem occurs with the Couchbase XDCR to Elasticsearch.

I'm using a plugin called elasticsearch-transport-couchbase which perfectly fine without TLS and Basic Auth enabled on the Elasticsearch cluster. But when enabling that with Search-Guard I am not able to make that work.

As far as I can tell the issue lies with the elasticsearch-transport-couchbase plugin. This has also been discussed previously in some issues on their Github repo.

It is also the only plugin what I can find that can be used for XDCR from Couchbase.

I'm curious about other peoples experience with this. Is there anyone who have been in the same situation as I and been able to setup a XDCR from Couchbase to Elasticsearch with TLS?

Or perhaps there are some other more suitable tools that I can use that I have missed?

Answer 1

The Couchbase transport plugin doesn't support XDCR TLS yet, it's on the roadmap, but isn't going to happen soon. Search-guard adds SSL to the HTTP/REST endpoint in ES, but the plugin opens its own endpoint (on port 9091 by default) which Search-guard doesn't touch. I'll take a look at whether it's possible to extend search-guard to apply to the transport plugin - the main problem is on the Couchbase XDCR side, which doesn't expect SSL on the target endpoint.

Answer 2

A small update. We went around the issue by setting up a stunnel with xinetd. So all communication with ELS have to go through the stunnel where the TLS will terminate.

We blocked access to port 9200, and restricted 9091 to the Couchbase-cluster host and 9300 to the other ELS nodes only.

Seems to work good.

Answer 3

Version 4.0 of the Couchbase Elasticsearch connector supports secure connections to Couchbase Server and/or Elasticsearch.

Reference: https://docs.couchbase.com/elasticsearch-connector/4.0/secure-connections.html