How To: Change the password for Search Guard

Applies To:

GroupID 10

Business Requirement:

An unauthenticated threat actor can gain administrator access to Search Guard by entering the default credentials, i.e., admin: admin. In this way, this user has full access to the Elastic cluster and all indices. We want to prevent users from accessing Elasticsearch by using the default password.

Solution:

We can address this vulnerability by changing the default password for Elasticsearch.

Steps:

1. Open GroupID Management Console.

2. Go to the Replication node.

3. Go to the Search Guard Change Password section.

4. Provide the default password, which is admin, in the Current Password box.

5. Enter a new password in the New Password and Confirm New Password boxes.

6. Click Change Password.
   
   

7. Once you see the successful password change message, try logging into Elasticsearch in your browser with the new password to ensure that the password has been changed successfully.

   Note:

   Elastic service and replication automatically restart once you change the password. Any requests going to the Elastic service will be disrupted during the change process for 2 to 4 seconds only. Once you see the success message, everything is back to normal, which should be visible within seconds. If you have multiple GroupID servers, you need to perform the same steps on those servers also.

8. Once the password is changed on all the GroupID servers, verify the following:

   1. Verify the Elastic cluster state by executing the following URL:

      http://ServerName:9200/_cluster/state/master_node,nodes?pretty

   2. Verify the cluster health by executing the following URL:

      http://ServerName:9200/_cluster/health?pretty

   3. In the end, all nodes should be in green. Verify by executing the following URL:

      http://ServerName:9200/_cat/indices?

       

   Note:

   Make sure that you keep a copy of the new password safe, as this is not easily recoverable.