<commit_before>#Search Guard 2 for Elasticsearch 2.3.4

Search Guard 2 (compatible with Elasticsearch 2.3.4)

## Documentation

[Additional documentation is provided here](https://github.com/floragunncom/search-guard-docs)

## Quick Start

If you want to try out Search Guard, we recommend to download the [Search Guard Bundle](https://github.com/floragunncom/search-guard/wiki/Search-Guard-Bundle). This is an Elasticsearch installation, preconfigured with Search Guard. It contains all enterprise features and templates for all configuration files. Just download, unzip and you're ready to go! 
##Roadmap
This is almost a complete rewrite of Search Guard 1 which comes with a lot of new features:

* Configuration hot reloading
* Open SSL support
* Easier to configure
 * Syntax is more easy
 * Admin CLI tool introduced (sgadmin)
 
Advanced functionalities like LDAP and Kerberos authentication/authorization as well as DLS/FLS are also available as separate and commercial licensed add-ons (but still Open Source). See https://github.com/floragunncom/search-guard/wiki

##Support
* Commercial support now available through [floragunn UG](http://floragunn.com)
* Community support available via [google groups](https://groups.google.com/forum/#!forum/search-guard)
* Follow us and get community support on twitter [@searchguard](https://twitter.com/searchguard)

##Installation

* Install latest version of [search-guard-ssl plugin](https://github.com/floragunncom/search-guard-ssl)
 * ``sudo bin/plugin install -b com.floragunn/search-guard-ssl/2.3.4.14``

* Install search-guard-2 plugin
 * ``sudo bin/plugin install -b com.floragunn/search-guard-2/2.3.4.3``
 
(See also the [Vagrant file](https://github.com/floragunncom/search-guard/blob/master/Vagrantfile) we provide)

Both plugins need to be installed on every node in the cluster. Tribe nodes are not yet supported.

After the plugins are installed you need to configure them. ``search-guard-ssl`` needs to be configured statically
in elasticsearch.yml (any change needs a restart of the node). See [search-guard-ssl documentation](https://github.com/floragunncom/search-guard-ssl) how to configure it. ``search-guard-2`` needs only a single entry in elasticsearch.yml (see below), all other configuration is stored in Elasticsearch itself and can be dynamically changed without restarting a node or the cluster.

##Configuration

###SSL certificates
HTTP SSL is optional (but strongly recommended especially if you use HTTP Basic authentication which transmits clear text passwords). Transport SSL is mandatory and you have to generate certificates for the nodes.

There are generally two types of certificates you need to generate:

* Server/Node certificate: They need a special [Subject Alternative Name entry (san)](https://github.com/floragunncom/search-guard-ssl/blob/master/example-pki-scripts/gen_node_cert.sh) to identify
 * ``oid:1.2.3.4.5.5``
* Client certificates: Contains user DN, [see here](https://github.com/floragunncom/search-guard-ssl/blob/master/example-pki-scripts/gen_client_node_cert.sh)

###elasticsearch.yml

    searchguard.authcz.admin_dn:<commit_msg>README updated<commit_after>#Search Guard 2 for Elasticsearch 2.3.4

Search Guard 2 (compatible with Elasticsearch 2.3.4)

## Documentation

[Additional documentation is provided here](https://github.com/floragunncom/search-guard-docs)

## Quick Start

If you want to try out Search Guard, we recommend to download the [Search Guard Bundle](https://github.com/floragunncom/search-guard/wiki/Search-Guard-Bundle). This is an Elasticsearch installation, preconfigured with Search Guard. It contains all enterprise features and templates for all configuration files. Just download, unzip and you're ready to go! 
##Roadmap
This is almost a complete rewrite of Search Guard 1 which comes with a lot of new features:

* Configuration hot reloading
* Open SSL support
* Easier to configure
 * Syntax is more easy
 * Admin CLI tool introduced (sgadmin)
 
Advanced functionalities like LDAP and Kerberos authentication/authorization as well as DLS/FLS are also available as separate and commercial licensed add-ons (but still Open Source). See https://github.com/floragunncom/search-guard/wiki

##Support
* Commercial support now available through [floragunn UG](http://floragunn.com)
* Community support available via [google groups](https://groups.google.com/forum/#!forum/search-guard)
* Follow us and get community support on twitter [@searchguard](https://twitter.com/searchguard)

##Installation

* Install latest version of [search-guard-ssl plugin](https://github.com/floragunncom/search-guard-ssl)
 * ``sudo bin/plugin install -b com.floragunn/search-guard-ssl/2.3.4.14``

* Install search-guard-2 plugin
 * ``sudo bin/plugin install -b com.floragunn/search-guard-2/2.3.4.4``
 
(See also the [Vagrant file](https://github.com/floragunncom/search-guard/blob/master/Vagrantfile) we provide)

Both plugins need to be installed on every node in the cluster. Tribe nodes are not yet supported.

After the plugins are installed you need to configure them. ``search-guard-ssl`` needs to be configured statically
in elasticsearch.yml (any change needs a restart of the node). See [search-guard-ssl documentation](https://github.com/floragunncom/search-guard-ssl) how to configure it. ``search-guard-2`` needs only a single entry in elasticsearch.yml (see below), all other configuration is stored in Elasticsearch itself and can be dynamically changed without restarting a node or the cluster.

##Configuration

###SSL certificates
HTTP SSL is optional (but strongly recommended especially if you use HTTP Basic authentication which transmits clear text passwords). Transport SSL is mandatory and you have to generate certificates for the nodes.

There are generally two types of certificates you need to generate:

* Server/Node certificate: They need a special [Subject Alternative Name entry (san)](https://github.com/floragunncom/search-guard-ssl/blob/master/example-pki-scripts/gen_node_cert.sh) to identify
 * ``oid:1.2.3.4.5.5``
* Client certificates: Contains user DN, [see here](https://github.com/floragunncom/search-guard-ssl/blob/master/example-pki-scripts/gen_client_node_cert.sh)

###elasticsearch.yml

    searchguard.authcz.admin_dn:
{'fraction_non_alphanumeric': 0.09231258952729587, 'fraction_numerical': 0.008594620404265478, 'mean_word_length': 4.9620493358633775, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 20, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 6, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 4, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '546923', 'n_tokens_mistral': 1777, 'n_tokens_neox': 1712, 'n_words': 656}