DCA Hardened Search and Analytics Engine for OpenSearch — Support & Quick Start

At a glance

Quick start

This is the listing's usage information, verbatim. Every command in it is run by our QA on a freshly launched instance before an image version can publish, so the text and the tested procedure cannot drift apart.

After launch:

1. Connect over SSH as the opc user with the key you supplied at launch:

   ssh opc@<public-ip>

2. OpenSearch runs as a systemd service bound to loopback (REST 9200 over HTTPS, transport 9300). The first start also initialises the security index, so allow a minute or two. Check status:

   sudo systemctl status opensearch

3. The admin password and the TLS certificates were generated uniquely for this instance at first boot. Read the credentials (root only):

   sudo cat /root/.opensearch_default_credentials

4. Smoke-test from the instance (the instance's own CA is at /etc/opensearch/certs/root-ca.pem):

   curl --cacert /etc/opensearch/certs/root-ca.pem -u admin:'<password>' https://localhost:9200
   curl --cacert /etc/opensearch/certs/root-ca.pem -u admin:'<password>' https://localhost:9200/_cluster/health

5. To reach the node from your application tier, expose the REST layer deliberately — add to /etc/opensearch/opensearch.yml:

   http.host: 0.0.0.0
   then: sudo systemctl restart opensearch

   Port 9200 is already permitted in the host firewall. Restrict it in your VCN security list to the application tier's CIDR; never expose it to the internet. The transport port (9300) and the Performance Analyzer port (9600) remain blocked by the host firewall even after this change. Clients must trust root-ca.pem, or replace certs/node.pem and certs/node-key.pem with a certificate issued by your own CA whose SAN carries the node's private DNS name, and update plugins.security.nodes_dn to match.

6. Data lives in /var/lib/opensearch; logs in /var/log/opensearch. For anything beyond evaluation, attach a block volume, mount it at /var/lib/opensearch before loading data, and raise the heap in /etc/opensearch/jvm.options (-Xms/-Xmx, default 1g) to half of the instance's memory.
7. Rotate the admin password at any time with the Security plugin's Account API (the admin user is deliberately not marked reserved, so it can change its own password with basic auth); this keeps every other user intact:

   curl --cacert /etc/opensearch/certs/root-ca.pem -u admin:'<password>' -X PUT https://localhost:9200/_plugins/_security/api/account -H 'Content-Type: application/json' -d '{"current_password":"<password>","password":"<new-password>"}'

   The new password must be strong (the plugin scores it; a long random string passes). Create additional users with the Security REST API (PUT _plugins/_security/api/internalusers/<name>) rather than sharing admin. If the admin password is lost, the credentials file holds a recovery recipe that uses securityadmin.sh with the instance's admin certificate. Note that securityadmin.sh -f replaces the ENTIRE internal-user set with the file you give it: retrieve the current users first (securityadmin.sh -r) and edit that copy, and never upload the image's /etc/opensearch/opensearch-security/internal_users.yml over a node on which other users exist.

8. Three optional features are removed at build because their upstream builds embed libraries with unpatched vulnerabilities: Security Analytics, Notifications and Skills. The node's own libraries and every other bundled plugin are patched instead. To add one back, accepting those libraries, install it from Maven Central and restart OpenSearch:

   sudo env OPENSEARCH_PATH_CONF=/etc/opensearch /usr/share/opensearch/bin/opensearch-plugin install org.opensearch.plugin:opensearch-security-analytics:$(rpm -q --qf '%{VERSION}' opensearch).0

   (Notifications: install opensearch-notifications-core, then notifications; Skills: opensearch-skills.) Updating to a newer OpenSearch release with dnf reinstalls all three from that release.

The image is CVE-patched at build time. Apply ongoing updates, including OpenSearch 3.x releases from the enabled upstream repository, with:

sudo dnf -y update

What the image provides

• OpenSearch 3.8.0, the newest stable 3.x release, installed from the project's official 3.x RPM repository with both package-signature and repository-signature verification enforced, running as the dedicated unprivileged opensearch service on the JDK bundled by the upstream distribution. The repository remains enabled so security fixes flow through dnf update.
• The Security plugin enabled with instance-unique TLS: on first boot the image mints its own root CA, node certificate and admin certificate, and the REST API answers only over HTTPS. The upstream demo certificates and demo accounts are never installed — the package's demo installer is disabled at build, and the build refuses to capture if any credential material is present.
• An instance-unique admin password, bcrypt-hashed with the plugin's own tool on first boot and surfaced to the operator over SSH — never a shared secret baked into the image.
• Safe-by-default network posture: the node listens on loopback until you expose it deliberately with one documented setting. The REST port (9200) is declared in the host firewall; the transport and Performance Analyzer ports stay behind the firewall's default-deny. Single-node discovery, a 1 GB heap and vm.max_map_count are preconfigured.
• Bundled Java libraries patched past the upstream release: the netty, Apache HttpCore 5, Jackson and JLine jars that the distribution ships with fixable HIGH and CRITICAL advisories are replaced with their fixed releases, including the node's own network layer. Three optional features whose upstream builds embed vulnerable libraries that cannot be patched in place — Security Analytics, Notifications and Skills — are removed, and the usage information shows how to reinstall them.
• A locked-down systemd service and security hardening aligned to the Oracle Cloud Marketplace image standards: SELinux enforcing, host firewall default-deny with only SSH and 9200 permitted, no account with a usable password, no stray keys, and the image fully patched at build time.

Still stuck?

Email support@dcassociatesgroup.com (response within 1 business day) or use the contact form. Include the listing name, your OCI region, the instance OCID and the output of sudo journalctl -u <service> -n 100 for the unit named in the quick start.

OpenSearch® is a registered trademark of LF Projects, LLC. This image is an independent hardened distribution and is not affiliated with, endorsed by, or sponsored by the OpenSearch Project or LF Projects, LLC.