# The naked cloud: elasticsearch is stretch but doesn’t cover security

- Link: https://www.agilicus.com/the-naked-cloud-elasticsearch-is-stretch-but-doesnt-cover-security/
- Published: 2019-04-25T12:45:00+00:00
- Author: Don Bowman

Similar to the [previous post](https://blog.donbowman.ca/2018/04/10/the-naked-cloud-insecure-by-design-or-how-you-cant-push-a-rope/),
there are a lot of infrastructural components that support today’s modern fancy 
application stacks. One of them, [Elasticsearch](https://www.elastic.co/), is the
example used in this post. Its a simple schema-less database that allows you to 
scale in and out, drop stuff in, and query later. Add a blob and some keys and away
you go, unpestered by things like security or scale or failure modes.

So, once again, using everyone’s favourite search engine [Shodan.io](https://www.shodan.io/),
lets snoop around on information which is already public. We find http://111.231.223.122:
9200/, used by Tencent cloud computing. It has 36GB indexed in its 3 nodes. If we
look at its API, we see that it (thinks it) is using all private IP (RFC 1918) space.

    ```wp-block-code
    $ curl http://111.231.223.122:9200/_nodes/_local | python -mjson.tool
    ...

    "host": "10.244.2.0",
    "http": {
    "bound_address": [
    "0.0.0.0:9200"
    ],
    "max_content_length_in_bytes": 104857600,
    "publish_address": "10.244.2.0:9200"
    },
    ```

So the cognitive gap here is “its a private IP, why should I need access control,
firewall, passwords?” Well, cuz ‘floating IP’. You see, an IP is not in and of itself
a trustworthy indication of who someone is or where they come from. You see, in 
this case, they are running Elasticsearch on Kubernetes. Kubernetes has assigned
private IP’s internally, but an Ingress controller (a load balancer of some sort)
has a public IP and reaches the internals from it.

Does this machine accept adding new data:

    ```wp-block-code
    curl -H "Content-Type: application/json" \
      -XPUT 'http://111.231.223.122:9200/blog/user/dilbert' 
      -d '{ "name" : "Dilbert Brown" }'
    {"_index":"blog",
     "_type":"user",
     "_id":"dilbert",
     "_version":2,
     "result":"updated",
     "_shards": {
      "total":2,
      "successful":2,
      "failed":0},
     "_seq_no":1,
     "_primary_term":1}
    ```

Does it allow querying?

    ```wp-block-code
    curl -XGET 'http://111.231.223.122:9200/blog/user/dilbert?pretty=true'
    {
     "_index" : "blog",
     "_type" : "user",
     "_id" : "dilbert",
     "_version" : 2,
     "found" : true,
     "_source" : {
      "name" : "Dilbert Brown"
      }
    }
    ```

yes. Which means it allows querying all 36GB of its information. You could even 
join the cluster if you wanted.

So it seems that not only is our top-level naked (from the earlier post), but our
middleware is naked too. It seems the cloud is a sort of nudist resort.

And, funny story, you see, I was going to find a picture to spice this article up.
But all the ‘naked elastic middle’ image searches are a bit off-colour. But then
I found that there is a Naturist (Nudist) park in Ontario that [accepts](http://www.naturistdirectory.com/a/1188/Bare-Oaks-Family-Naturist-Park-accepts-Bitcoin)
[Bitcoin](http://www.canadianbusiness.com/companies-and-industries/bare-oaks-nudist-naturist-bitcoin/).
So thus the image above.