Adding security installation information #20231130

_security/configuration/disable.md → _security/configuration/disable-enable-security.md

@@ -1,24 +1,26 @@
 ---
 layout: default
-title: Disabling security
+title: Disabling and enabling the Security plugin
 parent: Configuration
 nav_order: 40
+has_toc: true
 redirect_from: 
  - /security-plugin/configuration/disable/
 ---
 
-# Disabling security
+# Disabling and enabling the Security plugin
 
-You might want to temporarily disable the Security plugin to make testing or internal usage more straightforward. The Security plugin is actually two plugins: one for OpenSearch and one for OpenSearch Dashboards. You can use the OpenSearch plugin independently, but the OpenSearch Dashboards plugin requires a secured OpenSearch cluster. 
+Depending on the temporarily disable the Security plugin to make testing or internal usage more straightforward. The Security plugin is actually two plugins: one for OpenSearch and one for OpenSearch Dashboards. You can use the OpenSearch plugin independently, but the OpenSearch Dashboards plugin requires a secured OpenSearch cluster. 
+
+## Disabling security
 
 To disable the OpenSearch Security plugin, add the following line in `opensearch.yml`:
 
 ```yml
 plugins.security.disabled: true
 ```
 
-
-## Removing the OpenSearch plugin
+### Removing the OpenSearch plugin
 
 A more permanent option is to remove the Security plugin entirely:
 
@@ -35,13 +37,13 @@ Disabling or removing the plugin exposes the configuration index for the Securit
 {: .warning }
 
 
-## Removing the OpenSearch Dashboards plugin
+### Removing the OpenSearch Dashboards plugin
 
 If you disable the Security plugin in `opensearch.yml` (or delete the plugin entirely) and still want to use OpenSearch Dashboards, you must remove the corresponding OpenSearch Dashboards plugin. For more information, see [OpenSearch Dashboards remove plugins]({{site.url}}{{site.baseurl}}/install-and-configure/install-dashboards/plugins/#remove-plugins).
 
 Refer to the following installation types to remove the OpenSearch Dashboards plugin.
 
-### Docker
+#### Docker
 
 1. Remove all Security plugin configuration settings from `opensearch_dashboards.yml` or place the example file in the same folder as the `Dockerfile`:
 
@@ -70,7 +72,7 @@ Refer to the following installation types to remove the OpenSearch Dashboards pl
 1. Change `OPENSEARCH_HOSTS` or `opensearch.hosts` to `http://` rather than `https://`.
 1. Enter `docker-compose up`.
 
-### Tarball 
+#### Tarball 
 
 1. Navigate to the `/bin` directory in your OpenSearch Dashboards installation folder and stop the running OpenSearch Dashboards instance by pressing `Ctrl + C`.
 
@@ -93,7 +95,7 @@ Refer to the following installation types to remove the OpenSearch Dashboards pl
    ./bin/opensearch-dashboards
    ```
 
-### RPM and Debian 
+#### RPM and Debian 
 
 1. Stop the running instance of OpenSearch Dashboards by using the following command: 
 
@@ -119,3 +121,60 @@ Refer to the following installation types to remove the OpenSearch Dashboards pl
    ```bash
    sudo systemctl start opensearch-dashboards
    ```
+
+## Enabling security
+
+The default version of OpenSearch comes with Security features pre-installed, however if the Security plugin was [disabled]({{site.url}}{{site.baseurl}}/security/configuration/disable-enable-security/) or OpenSearch was installed without security, for example, using the minimal distribution method, you can enable the plugin as follows.
+
+A full cluster restart is necessary to enable security features.
+{: .warning}
+
+### Installing the OpenSearch plugin
+
+Use the following steps to enable security:
+
+1. Disable shard allocation and stop all nodes in order to prevent shards from moving around when the cluster is restarted.
+
+  ```json
+  curl -XPUT "http://localhost:9200/_cluster/settings" -H 'Content-Type: application/json' -d '{
+    "transient": {
+      "cluster.routing.allocation.enable": "none"
+      }
+   }'
+  ```
+  {% include copy.html %}
+
+2. Install the Security plugin on all nodes in your cluster
+
+  ```bash
+  bin/opensearch-plugin install opensearch-security
+  ```
+  {% include copy.html %}
+
+3. Add the necessary configuration to opensearch.yml for TLS encryption.
+[Configuration]({{site.url}}{{site.baseurl}}/install-and-configure/configuring-opensearch/security-settings/) details different settings which need to be configured.
+
+4. Create the `OPENSEARCH_INITIAL_ADMIN_PASSWORD` variable. For more information, see [Setting up a custom admin password](https://opensearch.org/docs/latest/security/configuration/demo-configuration/#setting-up-a-custom-admin-password).
+
+5. Restart the nodes and reenable shard allocation.
+
+   ```json
+   curl -XPUT "http://localhost:9200/_cluster/settings" -H 'Content-Type: application/json' -d '{
+     "transient": {
+      "cluster.routing.allocation.enable": "all"
+     }
+   }'
+   ```
+   {% include copy.html %}
+
+### Installing the OpenSearch Dashboards plugin
+
+1. Stop running your OpenSearch Dashboards cluster. 
+2. Install the Security plugin:
+
+   ```bash
+      ./bin/opensearch-dashboards-plugin install securityDashboards
+   ```
+
+4. Add necessary [Configuration]({{site.url}}{{site.baseurl}}/install-and-configure/install-dashboards/tls/) settings in the `opensearch_dashboards.yml`
+5. Start OpenSearch Dashboards. You should be prompted to enter your log in credentials. 

_security/configuration/index.md

@@ -22,7 +22,7 @@ The plugin includes demo certificates so that you can get up and running quickly
 1. Start OpenSearch.
 1. [Add users, roles, role mappings, and tenants]({{site.url}}{{site.baseurl}}/security/access-control/index/).
 
-If you don't want to use the plugin, see [Disable security]({{site.url}}{{site.baseurl}}/security/configuration/disable).
+If you don't want to use the plugin, see [Disable security]({{site.url}}{{site.baseurl}}/security/configuration/disable-enable-security/).
 
 The Security plugin has several default users, roles, action groups, permissions, and settings for OpenSearch Dashboards that use kibana in their names. We will change these names in a future release.
 {: .note }