|
I'm the lead engineer for Elasticsearch security. I'm sorry - I have never seen that specific post on our forums before, but the poster was mistaken and by not correcting it at the time, we have allowed incorrect information to perpetuate. In versions where security was a paid feature, if a trial license expired, security would remain enabled, but certain operations would be rejected for all users (per the warning text "Cluster health, cluster stats and indices stats operations are blocked") We intentionally did not open the cluster to be world readable/writable. The administrator would be left with a cluster that was secure, but blocked access to some functions that are necessary for running a production cluster. It was up to them to explicitly upgrade to a paid license and re-enable those APIs, or downgrade to a "basic" license which required acknowledgement that security would be disabled. An example (this is from 6.7.0 because it's the newest version I have installed at the moment, where security was not free. This was true at the time the original forum post was written - I just tested 5.2.0 as well, and the results are the same, with slightly different error messages): License state: license [fc5bee69-f086-4989-a32a-5db329692363] mode [trial] - valid
license [fc5bee69-f086-4989-a32a-5db329692363] - expired
recovered [1] indices into cluster_state
LICENSE [EXPIRED] ON [SATURDAY, SEPTEMBER 28, 2019].
Curl without credentials: curl http://localhost:9200/
{"error":{"root_cause":[{"type":"security_exception","reason":"missing authentication token for REST request [/]","header":{"WWW-Authenticate":["ApiKey","Basic realm=\"security\" charset=\"UTF-8\""]}}],"type":"security_exception","reason":"missing authentication token for REST request [/]","header":{"WWW-Authenticate":["ApiKey","Basic realm=\"security\" charset=\"UTF-8\""]}},"status":401}%
Curl with credentials: curl -u elastic http://localhost:9200/
Enter host password for user 'elastic':
{
"name" : "node1",
"cluster_name" : "es-670",
...
Blocked cluster health: curl -u elastic http://localhost:9200/_cluster/health
Enter host password for user 'elastic':
{"error":{"root_cause":[{"type":"security_exception","reason":"current license is non-compliant for [security]","license.expired.feature":"security"}],"type":"security_exception","reason":"current license is non-compliant for [security]","license.expired.feature":"security"},"status":403}
Logs: blocking [indices:monitor/stats] operation due to expired license. ...
However, as mentioned by other sibling comments, security has been included in the free license since May last year, so as far as security is concerned, there is no longer a choice to make when a trial expires.(Disclosure, as mentioned at the top, I work for Elastic) |