Configure Kerberos
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless
Generally available
Stack
Generally available
You can specify Kerberos options with any output or input that supports Kerberos, like Elasticsearch.
The following encryption types are supported:
- aes128-cts-hmac-sha1-96
- aes128-cts-hmac-sha256-128
- aes256-cts-hmac-sha1-96
- aes256-cts-hmac-sha384-192
- des3-cbc-sha1-kd
- rc4-hmac
Example output config with Kerberos password based authentication:
output.elasticsearch.hosts: ["http://my-elasticsearch.elastic.co:9200"]
output.elasticsearch.kerberos.auth_type: password
output.elasticsearch.kerberos.username: "elastic"
output.elasticsearch.kerberos.password: "changeme"
output.elasticsearch.kerberos.config_path: "/etc/krb5.conf"
output.elasticsearch.kerberos.realm: "ELASTIC.CO"
The service principal name for the Elasticsearch instance is constructed from these options. Based on this configuration it is going to be HTTP/my-elasticsearch.elastic.co@ELASTIC.CO.
You can specify the following options in the kerberos section of the auditbeat.yml config file:
The enabled setting can be used to enable the kerberos configuration by setting it to true. The default value is true.
Kerberos settings are disabled if either enabled is set to false or the kerberos section is missing.
There are two options to authenticate with Kerberos KDC: password and keytab.
password expects the principal name and its password. When choosing keytab, you have to specify a principal name and a path to a keytab. The keytab must contain the keys of the selected principal. Otherwise, authentication will fail.
You need to set the path to the krb5.conf, so Auditbeat can find the Kerberos KDC to retrieve a ticket. Mutually exclusive with krb5_conf.
The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Stack
Planned
Planned
Inline krb5.conf body. Use this instead of config_path when the config should travel with the settings rather than live in a file on the host.
Name of the principal used to connect to the output.
If you configured password for auth_type, you have to provide a password for the selected principal.
If you configured keytab for auth_type, you have to provide the path to the keytab of the selected principal.
This option can only be configured for Kafka. It is the name of the Kafka service, usually kafka.
Name of the realm where the output resides.
Enable Kerberos FAST authentication. This may conflict with some Active Directory installations. The default is false.