CIS OpenSearch Benchmark

This recommendation verifies that OpenSearch is running the latest stable version on the OpenSearch search and analytics engine. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OpenSearch search and analytics engine vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify OpenSearch version
curl -s -u admin:admin https://localhost:9200 -k | python3 -m json.tool | grep 'version'

# Update OpenSearch to latest stable
sudo apt-get update && sudo apt-get install --only-upgrade opensearch
# Or via tarball:
wget https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/opensearch-2.x-linux-x64.tar.gz
sudo systemctl restart opensearch

This recommendation verifies that OpenSearch runs as a dedicated non-root user on the OpenSearch search and analytics engine. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OpenSearch search and analytics engine vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check OpenSearch runs as dedicated user
ps -eo user,pid,comm | grep opensearch
grep '^opensearch' /etc/passwd

# Configure dedicated user
useradd -r -s /usr/sbin/nologin opensearch
chown -R opensearch:opensearch /etc/opensearch /var/lib/opensearch /var/log/opensearch

This recommendation verifies that Security plugin is enabled and configured on the OpenSearch search and analytics engine. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OpenSearch search and analytics engine vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Security plugin is enabled
curl -s -u admin:admin https://localhost:9200/_plugins/_security/health -k
grep 'plugins.security.disabled' /etc/opensearch/opensearch.yml

# Enable Security plugin
# In opensearch.yml ensure:
# plugins.security.disabled: false (or remove the line)
# Verify security config exists:
ls /etc/opensearch/opensearch-security/
# Apply security config:
/usr/share/opensearch/plugins/opensearch-security/tools/securityadmin.sh \
  -cd /etc/opensearch/opensearch-security/ \
  -icl -nhnv -cacert /etc/opensearch/root-ca.pem \
  -cert /etc/opensearch/admin.pem -key /etc/opensearch/admin-key.pem

This recommendation verifies that RBAC roles are configured and default users removed on the OpenSearch search and analytics engine. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the OpenSearch search and analytics engine increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

# Check internal users and roles
curl -s -u admin:admin https://localhost:9200/_plugins/_security/api/internalusers -k | python3 -m json.tool | head -30
curl -s -u admin:admin https://localhost:9200/_plugins/_security/api/roles -k | python3 -m json.tool | head -30

# Configure RBAC roles and remove default users
# Edit /etc/opensearch/opensearch-security/internal_users.yml:
# Change default admin password:
# admin:
#   hash: <bcrypt hash of new password>
# Remove demo users (kibanaro, logstash, snapshotrestore)
# Apply with securityadmin.sh
# Create application-specific roles:
curl -s -u admin:newpass -X PUT https://localhost:9200/_plugins/_security/api/roles/read_only -k \
  -H 'Content-Type: application/json' \
  -d '{"cluster_permissions":["cluster_composite_ops_ro"],"index_permissions":[{"index_patterns":["*"],"allowed_actions":["read"]}]}'

This recommendation verifies that TLS is enabled for both transport and REST layers on the OpenSearch search and analytics engine. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OpenSearch search and analytics engine vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check TLS configuration
grep -E 'plugins.security.ssl' /etc/opensearch/opensearch.yml

# Configure TLS for transport and REST
# In opensearch.yml:
plugins.security.ssl.transport.pemcert_filepath: node-cert.pem
plugins.security.ssl.transport.pemkey_filepath: node-key.pem
plugins.security.ssl.transport.pemtrustedcas_filepath: root-ca.pem
plugins.security.ssl.transport.enforce_hostname_verification: true
plugins.security.ssl.http.enabled: true
plugins.security.ssl.http.pemcert_filepath: node-cert.pem
plugins.security.ssl.http.pemkey_filepath: node-key.pem
plugins.security.ssl.http.pemtrustedcas_filepath: root-ca.pem

This recommendation verifies that only TLS 1.2+ with strong ciphers is allowed on the OpenSearch search and analytics engine. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OpenSearch search and analytics engine vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check allowed TLS protocols and ciphers
grep -E 'ssl.http.enabled_protocols|ssl.http.enabled_ciphers' /etc/opensearch/opensearch.yml

# Restrict TLS protocols and ciphers
# In opensearch.yml:
plugins.security.ssl.http.enabled_protocols:
  - TLSv1.2
  - TLSv1.3
plugins.security.ssl.http.enabled_ciphers:
  - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
  - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
plugins.security.ssl.transport.enabled_protocols:
  - TLSv1.2
  - TLSv1.3

This recommendation verifies that audit logging is enabled for all categories on the OpenSearch search and analytics engine. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OpenSearch search and analytics engine vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check audit logging
grep -E 'plugins.security.audit' /etc/opensearch/opensearch.yml

# Enable audit logging
# In opensearch.yml:
plugins.security.audit.type: internal_opensearch
plugins.security.audit.config.log_request_body: true
plugins.security.audit.config.disabled_rest_categories: NONE
plugins.security.audit.config.disabled_transport_categories: NONE
plugins.security.audit.config.resolve_indices: true
plugins.security.audit.config.resolve_bulk_requests: true

This recommendation verifies that slow query and indexing logs are configured on the OpenSearch search and analytics engine. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OpenSearch search and analytics engine vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check slow log configuration
grep -E 'slowlog' /etc/opensearch/opensearch.yml
curl -s -u admin:admin https://localhost:9200/_cluster/settings -k | python3 -m json.tool | grep slow

# Configure slow query and index logging
curl -s -u admin:admin -X PUT https://localhost:9200/_cluster/settings -k \
  -H 'Content-Type: application/json' \
  -d '{
    "persistent": {
      "index.search.slowlog.threshold.query.warn": "10s",
      "index.search.slowlog.threshold.query.info": "5s",
      "index.indexing.slowlog.threshold.index.warn": "10s",
      "index.indexing.slowlog.threshold.index.info": "5s"
    }
  }'

This recommendation ensures that OpenSearch binds only to required interfaces on the OpenSearch search and analytics engine. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the OpenSearch search and analytics engine may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

# Check network binding
grep -E 'network.host|http.port|transport.port' /etc/opensearch/opensearch.yml
ss -tlnp | grep -E '9200|9300'

# Restrict network binding
# In opensearch.yml:
network.host: 10.0.1.5
http.port: 9200
transport.port: 9300
# Firewall:
ufw allow from 10.0.0.0/8 to any port 9200
ufw allow from 10.0.0.0/8 to any port 9300

This recommendation verifies that cluster discovery uses explicit seed hosts on the OpenSearch search and analytics engine. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OpenSearch search and analytics engine vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check cluster discovery settings
grep -E 'discovery|cluster.initial' /etc/opensearch/opensearch.yml

# Configure secure cluster discovery
# In opensearch.yml:
cluster.name: production-cluster
discovery.seed_hosts: ["node1.internal", "node2.internal", "node3.internal"]
cluster.initial_cluster_manager_nodes: ["node1", "node2", "node3"]
# Disable single-node discovery in production:
# discovery.type: single-node  # REMOVE THIS

This recommendation verifies that JVM heap and OS resource limits are configured on the OpenSearch search and analytics engine. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OpenSearch search and analytics engine vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check JVM heap and resource limits
cat /etc/opensearch/jvm.options | grep -E '^-Xm'
ulimit -a | grep -E 'open files|max user'

# Configure JVM and OS limits
# In /etc/opensearch/jvm.options:
-Xms4g
-Xmx4g
# In /etc/security/limits.d/opensearch.conf:
opensearch soft nofile 65536
opensearch hard nofile 65536
opensearch soft memlock unlimited
opensearch hard memlock unlimited
# In opensearch.yml:
bootstrap.memory_lock: true

This recommendation verifies that snapshot repository and backup schedule are configured on the OpenSearch search and analytics engine. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OpenSearch search and analytics engine vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check snapshot repository
curl -s -u admin:admin https://localhost:9200/_snapshot -k | python3 -m json.tool

# Configure snapshot backups
curl -s -u admin:admin -X PUT https://localhost:9200/_snapshot/backup_repo -k \
  -H 'Content-Type: application/json' \
  -d '{"type":"fs","settings":{"location":"/mnt/backups/opensearch","compress":true}}'
# Create snapshot policy (ISM):
# Schedule daily snapshots with 30-day retention
mkdir -p /mnt/backups/opensearch
chown opensearch:opensearch /mnt/backups/opensearch

This recommendation verifies that index state management policies are configured on the OpenSearch search and analytics engine. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OpenSearch search and analytics engine vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check index state management policies
curl -s -u admin:admin https://localhost:9200/_plugins/_ism/policies -k | python3 -m json.tool | head -30

# Configure ISM for index lifecycle
curl -s -u admin:admin -X PUT https://localhost:9200/_plugins/_ism/policies/retention_policy -k \
  -H 'Content-Type: application/json' \
  -d '{
    "policy": {
      "description": "Retention policy",
      "default_state": "hot",
      "states": [
        {"name": "hot", "transitions": [{"state_name": "delete", "conditions": {"min_index_age": "30d"}}]},
        {"name": "delete", "actions": [{"delete": {}}]}
      ]
    }
  }'

This setting ensures that file and directory permissions are restricted on the OpenSearch search and analytics engine. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the OpenSearch search and analytics engine is essential for defense in depth.

# Check file and directory permissions
stat -c '%a %U %G' /etc/opensearch/opensearch.yml
find /etc/opensearch -type f -perm /o=rwx -ls 2>/dev/null | head -10

# Restrict file permissions
chown -R opensearch:opensearch /etc/opensearch
chmod 640 /etc/opensearch/opensearch.yml
chmod 600 /etc/opensearch/*.pem
chmod 640 /etc/opensearch/opensearch-security/*.yml
chmod 750 /etc/opensearch
chmod 750 /var/lib/opensearch
chmod 750 /var/log/opensearch