Is there a way to disable security using an environment variable?

Security
,
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): Server 3.0.0

Describe the issue: Would like to disable the security plugins through environment variable. I’ve tried several such as DISABLE_SECURITY_PLUGIN=true, PLUGINS_SECURITY_DISABLED=true, and OPENSEARCH_PLUGINS_SECURITY_DISABLED=true. Seems the only way to do it is through opensearch.yml

Configuration: Out of the box installation, nothing changed except what I am trying to do as described above.

Relevant Logs or Screenshots:

java.lang.IllegalStateException: failed to load plugin class [org.opensearch.security.OpenSearchSecurityPlugin]
Likely root cause: OpenSearchException[No SSL configuration found]
        at org.opensearch.security.ssl.SslSettingsManager.loadConfigurations(SslSettingsManager.java:128)
        at org.opensearch.security.ssl.SslSettingsManager.buildSslContexts(SslSettingsManager.java:96)
        at org.opensearch.security.ssl.SslSettingsManager.<init>(SslSettingsManager.java:83)
        at org.opensearch.security.ssl.OpenSearchSecuritySSLPlugin.<init>(OpenSearchSecuritySSLPlugin.java:248)
        at org.opensearch.security.OpenSearchSecurityPlugin.<init>(OpenSearchSecurityPlugin.java:332)
        at java.base/jdk.internal.reflect.DirectConstructorHandleAccessor.newInstance(DirectConstructorHandleAccessor.java:62)
        at java.base/java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:502)
        at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:486)
        at org.opensearch.plugins.PluginsService.loadPlugin(PluginsService.java:840)
        at org.opensearch.plugins.PluginsService.loadBundle(PluginsService.java:788)
        at org.opensearch.plugins.PluginsService.loadBundles(PluginsService.java:582)
        at org.opensearch.plugins.PluginsService.<init>(PluginsService.java:197)
        at org.opensearch.node.Node.<init>(Node.java:533)
        at org.opensearch.node.Node.<init>(Node.java:460)
        at org.opensearch.bootstrap.Bootstrap$5.<init>(Bootstrap.java:243)
        at org.opensearch.bootstrap.Bootstrap.setup(Bootstrap.java:243)
        at org.opensearch.bootstrap.Bootstrap.init(Bootstrap.java:405)
        at org.opensearch.bootstrap.OpenSearch.init(OpenSearch.java:168)
        at org.opensearch.bootstrap.OpenSearch.execute(OpenSearch.java:159)
        at org.opensearch.common.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:110)
        at org.opensearch.cli.Command.mainWithoutErrorHandling(Command.java:138)
        at org.opensearch.cli.Command.main(Command.java:101)
        at org.opensearch.bootstrap.OpenSearch.main(OpenSearch.java:125)
        at org.opensearch.bootstrap.OpenSearch.main(OpenSearch.java:91)
2

You can uninstall the security plugin entirely with `./bin/opensearch-plugin remove opensearch-security`

FYI when using docker it automatically adds to opensearch.yml like this when DISABLE_SECURITY_PLUGIN is set to true

3

Hey @tuaris ,

Is there any issue or reason to why you want to remove the security plugin? Also if you need any more information on removing it you can check the following doc - Disabling and enabling the Security plugin - OpenSearch Documentation .

Leeroy.