github-mirrors/elasticsearch
1
0
Fork 0
mirror of https://github.com/elastic/elasticsearch.git synced 2025-06-28 17:34:17 -04:00
Code Issues Projects Releases Packages Wiki Activity

Make security non-optional

Browse source 
2.x has show so far that running with security manager is the way to go.
This commit make this non-optional. Users that need to pass their own rules
can still do this via the system configuration for the security manager. They
can even opt out of all security that way.
This commit is contained in:
Simon Willnauer 2016-01-22 13:00:50 +01:00
parent b77175ec2d
commit c50586599e
6 changed files with 10 additions and 39 deletions
Download patch file Download diff file Expand all files Collapse all files

21
docs/reference/modules/scripting/security.asciidoc
View file

@ -82,7 +82,7 @@ Returns the following exception:
[float]
== Dealing with Java Security Manager issues
If you encounter issues with the Java Security Manager, you have three options
If you encounter issues with the Java Security Manager, you have two options
for resolving these issues:
[float]
@ -92,25 +92,6 @@ The safest and most secure long term solution is to change the code causing
the security issue. We recognise that this may take time to do correctly and
so we provide the following two alternatives.
[float]
=== Disable the Java Security Manager
deprecated[2.2.0,The ability to disable the Java Security Manager will be removed in a future version]
You can disable the Java Security Manager entirely with the
`security.manager.enabled` command line flag:
[source,sh]
-----------------------------
./bin/elasticsearch --security.manager.enabled false
-----------------------------
WARNING: This disables the Security Manager entirely and makes Elasticsearch
much more vulnerable to attacks! It is an option that should only be used in
the most urgent of situations and for the shortest amount of time possible.
Optional security is not secure at all because it **will** be disabled and
leave the system vulnerable. This option will be removed in a future version.
[float]
=== Customising the classloader whitelist