from Hacker News

Security for Elasticsearch is now free

by jasondc on 5/20/19, 8:57 PM with 61 comments

  • by mrkstu on 5/20/19, 9:14 PM

    Free, not open source version. Obviously a reaction to Amazon's fork- not wanting to give them any code to pull into their version.

    It will be interesting to see if this is enough to retain the majority of the userbase or if we'll still see a majority migrate to the 'Open Distro' fork.

  • by haney on 5/20/19, 9:35 PM

    I know it's hard to make a buck with an open source business model but deciding to charge more for security related features is always so frustrating to me. It leads to a culture of insecure deployments in environments when the business is trying to save money. Differentiate on storage or number of cores or something, anything but auth/security. I'm glad they've finally reversed this.

  • by mrmondo on 5/21/19, 8:34 AM

    This (while perhaps not perfect) is massive for us, it’s going to be especially useful for Kibana authentication to add readonly and write users, something we’ve wanted for a long time but haven’t been able to afford as a non-profit, charitable organisation.

    I know it’s not all 100% open source, but it’s better than a nginx reverse proxy hack or similar.

    Thank you Elastic for continuing to create fantastic software.

  • by tedk-42 on 5/21/19, 12:16 AM

    Running Elasticsearch on K8s storing 16TB of compressed logs across 6 data nodes and ~4600 shards.

    We're a really happy ES customer. We've on ESv6 at the moment and it's been running amazingly for us. We've halved our storage and running costs by moving from 5 to 6.

    We've always been a licensed customer and they are in front of AWS with their features (we run our k8s stack on AWS though :) )

  • by KenanSulayman on 5/20/19, 9:28 PM

    Interesting. Three hours ago someone in our Ops team shared a link to "Open Distro for Elasticsearch" [1] and it's also featured on the AWS console login page.

    Is this a very rushed reaction to it? Or is this related? I would really love to have a clarification of what's happening in that space.

    [1] https://opendistro.github.io/for-elasticsearch/

  • by vorpalhex on 5/20/19, 9:28 PM

    Too little too late? Trying to charge for TLS was a very poor move and it's made me not trust ElasticSearch...

  • by mattupstate on 5/21/19, 2:16 AM

    There's also a lesser known project out there: https://search-guard.com/

    Paired with an OpenResty reverse proxy I was able to set up a reasonably secure cluster back when X-Pack was prohibitively expensive and the AWS offering wasn't under their BAA.

    Big thanks to that team of contributors!

  • by reilly3000 on 5/21/19, 5:27 AM

    Some of the worst breaches of 2017-19 have been due to open ES clusters, some on AWS. This is a welcome change. I just spun our AWS ES cluster down in favor of BigQuery, but while I was setting it up security for it was a big chore, with defaults that are in no way sane. AWS EC2 does a great job at secure defaults for auth and firewalls, RDS even moreso. Why was ES left to wag in the wind out of the box?