- X-Pack Reference for 6.0-6.2 and 5.x:
- Introduction
- Setting Up X-Pack
- Breaking Changes
- X-Pack APIs
- Graphing Connections in Your Data
- Profiling your Queries and Aggregations
- Reporting from Kibana
- Securing the Elastic Stack
- Getting Started with Security
- How Security Works
- Setting Up User Authentication
- Configuring SAML Single-Sign-On on the Elastic Stack
- Configuring Role-based Access Control
- Auditing Security Events
- Encrypting Communications
- Restricting Connections with IP Filtering
- Cross Cluster Search, Tribe, Clients and Integrations
- Reference
- Monitoring the Elastic Stack
- Alerting on Cluster and Index Events
- Machine Learning in the Elastic Stack
- Troubleshooting
- Getting Help
- X-Pack security
- Can’t log in after upgrading to 6.2.4
- Some settings are not returned via the nodes settings API
- Authorization exceptions
- Users command fails due to extra arguments
- Users are frequently locked out of Active Directory
- Certificate verification fails for curl on Mac
- SSLHandshakeException causes connections to fail
- Common SSL/TLS exceptions
- Internal Server Error in Kibana
- Setup-passwords command fails due to connection failure
- X-Pack Watcher
- X-Pack monitoring
- X-Pack machine learning
- Limitations
- License Management
- Release Notes
WARNING: Version 6.2 of the Elastic Stack has passed its EOL date.
This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.
Tribe Nodes and Security
editTribe Nodes and Security
editTribe nodes act as a federated client across multiple clusters. When using tribe nodes with secured clusters, all clusters must have X-Pack security enabled and share the same security configuration (users, roles, user-role mappings, SSL/TLS CA). The tribe node itself also must be configured to grant access to actions and indices on all of the connected clusters, as security checks on incoming requests are primarily done on the tribe node itself.
Support for tribe nodes in Kibana was added in v5.2.
To use a tribe node with secured clusters:
- Install X-Pack on the tribe node and every node in each connected cluster.
-
Enable encryption globally. To encrypt communications, you must enable enable SSL/TLS on every node.
To simplify SSL/TLS configuration, use the same certificate authority to generate certificates for all connected clusters.
-
Configure the tribe in the tribe node’s
elasticsearch.yml
file. You must specify each cluster that is a part of the tribe and configure discovery and encryption settings per cluster. For example, the following configuration adds two clusters to the tribe:tribe: on_conflict: prefer_cluster1 c1: cluster.name: cluster1 discovery.zen.ping.unicast.hosts: [ "cluster1-node1:9300", "cluster1-node2:9300"] xpack.ssl.key: /home/es/config/x-pack/es-tribe-01.key xpack.ssl.certificate: /home/es/config/x-pack/es-tribe-01.crt xpack.ssl.certificate_authorities: [ "/home/es/config/x-pack/ca.crt" ] xpack.security.transport.ssl.enabled: true xpack.security.http.ssl.enabled: true c2: cluster.name: cluster2 discovery.zen.ping.unicast.hosts: [ "cluster2-node1:9300", "cluster2-node2:9300"] xpack.ssl.key: /home/es/config/x-pack/es-tribe-01.key xpack.ssl.certificate: /home/es/config/x-pack/es-tribe-01.crt xpack.ssl.certificate_authorities: [ "/home/es/config/x-pack/ca.crt" ] xpack.security.transport.ssl.enabled: true xpack.security.http.ssl.enabled: true
-
Configure the same index privileges for your users on all nodes, including the tribe node. The nodes in each cluster must grant access to indices in other connected clusters as well as their own.
For example, let’s assume
cluster1
andcluster2
each have a indicesindex1
andindex2
. To enable a user to submit a request through the tribe node to search both clusters:-
On the tribe node and both clusters, define a
tribe_user
role that has read access toindex1
andindex2
:tribe_user: indices: 'index*': search
-
Assign the
tribe_user
role to a user on the tribe node and both clusters. For example, run the following command on each node to createmy_tribe_user
and assign thetribe_user
role:./bin/shield/users useradd my_tribe_user -p password -r tribe_user
Each cluster needs to have its own users with admin privileges. You cannot perform administration tasks such as create index through the tribe node, you must send the request directly to the appropriate cluster.
-
-
To enable selected users to retrieve merged cluster state information for the tribe from the tribe node, grant them the cluster
monitor
privilege on the tribe node. For example, you could create atribe_monitor
role that assigns themonitor
privilege:tribe_monitor: cluster: monitor
- Start the tribe node. If you’ve made configuration changes to the nodes in the connected clusters, they also need to be restarted.
ElasticON events are back!
Learn about the Elastic Search AI Platform from the experts at our live events.
Register now