From 34f9366b258badbf687abaaff05fb09e7326d8b1 Mon Sep 17 00:00:00 2001 From: Landon Lengyel Date: Fri, 11 Apr 2025 10:11:05 -0600 Subject: [PATCH] Updating deprecated options Signed-off-by: Landon Lengyel Signed-off-by: Landon Lengyel Signed-off-by: Landon Lengyel --- .../configuring-opensearch/security-settings.md | 6 +++--- _install-and-configure/install-opensearch/docker.md | 2 +- _security/configuration/generate-certificates.md | 4 ++-- _security/configuration/tls.md | 4 ++-- _security/configuration/yaml.md | 2 +- 5 files changed, 9 insertions(+), 9 deletions(-) diff --git a/_install-and-configure/configuring-opensearch/security-settings.md b/_install-and-configure/configuring-opensearch/security-settings.md index 5a2d80c588a..e32b6ec8022 100644 --- a/_install-and-configure/configuring-opensearch/security-settings.md +++ b/_install-and-configure/configuring-opensearch/security-settings.md @@ -233,9 +233,9 @@ The Security plugin supports the following audit log settings: The Security plugin supports the following hostname verification and DNS lookup settings: -- `plugins.security.ssl.transport.enforce_hostname_verification` (Static): Whether to verify hostnames on the transport layer. Optional. Default is `true`. +- `transport.ssl.enforce_hostname_verification` (Static): Whether to verify hostnames on the transport layer. Optional. Default is `true`. -- `plugins.security.ssl.transport.resolve_hostname` (Static): Whether to resolve hostnames against DNS on the transport layer. Optional. Default is `true`. Only works if hostname verification is enabled. +- `transport.ssl.resolve_hostname` (Static): Whether to resolve hostnames against DNS on the transport layer. Optional. Default is `true`. Only works if hostname verification is enabled. For more information, see [Hostname verification and DNS lookup]({{site.url}}{{site.baseurl}}/security/configuration/tls/#advanced-hostname-verification-and-dns-lookup). @@ -389,7 +389,7 @@ plugins.security.roles_mapping_resolution: MAPPING_ONLY plugins.security.ssl.transport.pemcert_filepath: esnode.pem plugins.security.ssl.transport.pemkey_filepath: esnode-key.pem plugins.security.ssl.transport.pemtrustedcas_filepath: root-ca.pem -plugins.security.ssl.transport.enforce_hostname_verification: false +transport.ssl.enforce_hostname_verification: false plugins.security.ssl.http.enabled: true plugins.security.ssl.http.pemcert_filepath: esnode.pem plugins.security.ssl.http.pemkey_filepath: esnode-key.pem diff --git a/_install-and-configure/install-opensearch/docker.md b/_install-and-configure/install-opensearch/docker.md index 82ea43ff5e2..817b45e57b5 100644 --- a/_install-and-configure/install-opensearch/docker.md +++ b/_install-and-configure/install-opensearch/docker.md @@ -473,7 +473,7 @@ After configuring security settings, your custom `opensearch.yml` file might loo plugins.security.ssl.transport.pemcert_filepath: node1.pem plugins.security.ssl.transport.pemkey_filepath: node1-key.pem plugins.security.ssl.transport.pemtrustedcas_filepath: root-ca.pem -plugins.security.ssl.transport.enforce_hostname_verification: false +transport.ssl.enforce_hostname_verification: false plugins.security.ssl.http.enabled: true plugins.security.ssl.http.pemcert_filepath: node1.pem plugins.security.ssl.http.pemkey_filepath: node1-key.pem diff --git a/_security/configuration/generate-certificates.md b/_security/configuration/generate-certificates.md index 2316fd33bee..d2bac73cb80 100755 --- a/_security/configuration/generate-certificates.md +++ b/_security/configuration/generate-certificates.md @@ -77,7 +77,7 @@ openssl req -new -key admin-key.pem -out admin.csr Follow the prompts to fill in the details. You don't need to specify a challenge password. As noted in the [OpenSSL Cookbook](https://www.feistyduck.com/books/openssl-cookbook/){:target='\_blank'}, "Having a challenge password does not increase the security of the CSR in any way." -If you generate TLS certificates and have enabled hostname verification by setting `plugins.security.ssl.transport.enforce_hostname_verification` to `true` (default), be sure to specify a common name (CN) for each certificate signing request (CSR) that matches the corresponding DNS A record of the intended node. +If you generate TLS certificates and have enabled hostname verification by setting `transport.ssl.enforce_hostname_verification` to `true` (default), be sure to specify a common name (CN) for each certificate signing request (CSR) that matches the corresponding DNS A record of the intended node. If you want to use the same node certificate on all nodes (not recommended), set hostname verification to `false`. For more information, see [Configure TLS certificates]({{site.url}}{{site.baseurl}}/security/configuration/tls/#advanced-hostname-verification-and-dns-lookup). @@ -256,7 +256,7 @@ On one node, the security configuration portion of `opensearch.yml` might look l plugins.security.ssl.transport.pemcert_filepath: node1.pem plugins.security.ssl.transport.pemkey_filepath: node1-key.pem plugins.security.ssl.transport.pemtrustedcas_filepath: root-ca.pem -plugins.security.ssl.transport.enforce_hostname_verification: false +transport.ssl.enforce_hostname_verification: false plugins.security.ssl.http.enabled: true plugins.security.ssl.http.pemcert_filepath: node1.pem plugins.security.ssl.http.pemkey_filepath: node1-key.pem diff --git a/_security/configuration/tls.md b/_security/configuration/tls.md index 97e3b2b2799..9c6a25db727 100755 --- a/_security/configuration/tls.md +++ b/_security/configuration/tls.md @@ -156,8 +156,8 @@ In addition, when `resolve_hostname` is enabled, the Security plugin resolves th Name | Description :--- | :--- -`plugins.security.ssl.transport.enforce_hostname_verification` | Whether to verify hostnames on the transport layer. Optional. Default is `true`. -`plugins.security.ssl.transport.resolve_hostname` | Whether to resolve hostnames against DNS on the transport layer. Optional. Default is `true`. Only works if hostname verification is also enabled. +`transport.ssl.enforce_hostname_verification` | Whether to verify hostnames on the transport layer. Optional. Default is `true`. +`transport.ssl.resolve_hostname` | Whether to resolve hostnames against DNS on the transport layer. Optional. Default is `true`. Only works if hostname verification is also enabled. ## (Advanced) Client authentication diff --git a/_security/configuration/yaml.md b/_security/configuration/yaml.md index dff3819a937..2738b43b1a9 100644 --- a/_security/configuration/yaml.md +++ b/_security/configuration/yaml.md @@ -321,7 +321,7 @@ In addition to many OpenSearch settings, the `opensearch.yml` file contains path plugins.security.ssl.transport.pemcert_filepath: esnode.pem plugins.security.ssl.transport.pemkey_filepath: esnode-key.pem plugins.security.ssl.transport.pemtrustedcas_filepath: root-ca.pem -plugins.security.ssl.transport.enforce_hostname_verification: false +transport.ssl.enforce_hostname_verification: false plugins.security.ssl.http.enabled: true plugins.security.ssl.http.pemcert_filepath: esnode.pem plugins.security.ssl.http.pemkey_filepath: esnode-key.pem