In the previous blog " How to build an ElasticSearch cluster? 》Summarizes the steps to build an ES cluster. This article summarizes how to add user security authentication functions to the ES cluster, that is, set the access password for the ES cluster.
The free version before 6.8 did not include the security authentication function, and the later version opened some basic authentication functions, which is sufficient for ordinary users. For the sake of security, the access password is generally set to prevent hackers from cracking the server login password and then obtaining the ES data on the server. On the basis of the cluster built in the previous blog, add the following steps to complete the user security authentication function.
1. New configuration, each cluster node needs to be set.
Edit the elasticsearch.yml file:
[estestuser@vm-10-201-42-9 config]$ vi elasticsearch.yml
Add the following content:
xpack.security.enabled: true
xpack.license.self_generated.type: basic
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: elastic-certificates.p12
Make the above modifications on node 2 and node 3 respectively.
2. Generate TLS and identity verification, elastic-certificates.p12 file will be generated under config, transfer this file to the config directory of the other two nodes, pay attention to file permissions
[estestuser@vm-10-201-42-9 elasticsearch-7.1.1]$ bin/elasticsearch-certutil cert -out config/elastic-certificates.p12 -pass ""
WARNING: An illegal reflective access operation has occurred
WARNING: Illegal reflective access by org.bouncycastle.jcajce.provider.drbg.DRBG (file:/home/estestuser/elasticsearch-7.1.1/lib/tools/security-cli/bcprov-jdk15on-1.61.jar) to constructor sun.security.provider.Sun()
WARNING: Please consider reporting this to the maintainers of org.bouncycastle.jcajce.provider.drbg.DRBG
WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
WARNING: All illegal access operations will be denied in a future release
This tool assists you in the generation of X.509 certificates and certificate
signing requests for use with SSL/TLS in the Elastic stack.
The 'cert' mode generates X.509 certificate and private keys.
* By default, this generates a single certificate and key for use
on a single instance.
* The '-multiple' option will prompt you to enter details for multiple
instances and will generate a certificate and key for each one
* The '-in' option allows for the certificate generation to be automated by describing
the details of each instance in a YAML file
* An instance is any piece of the Elastic Stack that requires a SSL certificate.
Depending on your configuration, Elasticsearch, Logstash, Kibana, and Beats
may all require a certificate and private key.
* The minimum required value for each instance is a name. This can simply be the
hostname, which will be used as the Common Name of the certificate. A full
distinguished name may also be used.
* A filename value may be required for each instance. This is necessary when the
name would result in an invalid file or directory name. The name provided here
is used as the directory name (within the zip) and the prefix for the key and
certificate files. The filename is required if you are prompted and the name
is not displayed in the prompt.
* IP addresses and DNS names are optional. Multiple values can be specified as a
comma separated string. If no IP addresses or DNS names are provided, you may
disable hostname verification in your SSL configuration.
* All certificates generated by this tool will be signed by a certificate authority (CA).
* The tool can automatically generate a new CA for you, or you can provide your own with the
-ca or -ca-cert command line options.
By default the 'cert' mode produces a single PKCS#12 output file which holds:
* The instance certificate
* The private key for the instance certificate
* The CA certificate
If you specify any of the following options:
* -pem (PEM formatted output)
* -keep-ca-key (retain generated CA key)
* -multiple (generate multiple certificates)
* -in (generate certificates from an input file)
then the output will be be a zip file containing individual certificate/key files
Certificates written to /home/estestuser/elasticsearch-7.1.1/config/elastic-certificates.p12
This file should be properly secured as it contains the private key for
your instance.
This file is a self contained file and can be copied and used 'as is'
For each Elastic product that you wish to configure, you should copy
this '.p12' file to the relevant configuration directory
and then follow the SSL configuration instructions in the product guide.
After the above operations are completed, the certificate elastic-certificates.p12 will be generated under the config path, as shown below:
[estestuser@vm-10-201-42-9 elasticsearch-7.1.1]$ cd config/
[estestuser@vm-10-201-42-9 config]$ ll
total 48
-rw------- 1 estestuser estestuser 3443 Feb 24 09:31 elastic-certificates.p12
-rw-rw---- 1 estestuser estestuser 199 Feb 23 15:45 elasticsearch.keystore
-rw-rw---- 1 estestuser estestuser 3244 Feb 24 09:27 elasticsearch.yml
-rw-rw---- 1 estestuser estestuser 3544 Feb 23 16:15 jvm.options
-rw-rw---- 1 estestuser estestuser 17170 May 23 2019 log4j2.properties
-rw-rw---- 1 estestuser estestuser 473 May 23 2019 role_mapping.yml
-rw-rw---- 1 estestuser estestuser 197 May 23 2019 roles.yml
-rw-rw---- 1 estestuser estestuser 0 May 23 2019 users
-rw-rw---- 1 estestuser estestuser 0 May 23 2019 users_roles
Copy the certificates on node 1 to other nodes in turn:
[estestuser@vm-10-201-42-9 config]$ scp elastic-certificates.p12 estestuser@10.201.42.19:/home/estestuser/elasticsearch-7.1.1/config/
estestuser@10.201.42.19's password:
elastic-certificates.p12 100% 3443 2.8MB/s 00:00
[estestuser@vm-10-201-42-9 config]$ scp elastic-certificates.p12 [email protected]:/home/estestuser/elasticsearch-7.1.1/config/
[email protected]'s password:
elastic-certificates.p12 100% 3443 3.1MB/s 00:00
Three, restart the ES cluster
The ES cluster does not start, and the following add password operation cannot be performed, so restart 3 nodes in turn. Restart node 1 first.
[estestuser@vm-10-201-42-9 config]$ ps -ef|grep elasticsearch
estestu+ 10370 8753 0 09:34 pts/0 00:00:00 grep --color=auto elasticsearch
estestu+ 31979 1 0 Feb23 ? 00:02:21 /home/estestuser/elasticsearch-7.1.1/jdk/bin/java -Xms1g -Xmx1g -XX:+UseParallelGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -Des.networkaddress.cache.ttl=60 -Des.networkaddress.cache.negative.ttl=10 -XX:+AlwaysPreTouch -Xss1m -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djna.nosys=true -XX:-OmitStackTraceInFastThrow -Dio.netty.noUnsafe=true -Dio.netty.noKeySetOptimization=true -Dio.netty.recycler.maxCapacityPerThread=0 -Dlog4j.shutdownHookEnabled=false -Dlog4j2.disable.jmx=true -Djava.io.tmpdir=/tmp/elasticsearch-2970892740801116994 -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=data -XX:ErrorFile=logs/hs_err_pid%p.log -Xlog:gc*,gc+age=trace,safepoint:file=logs/gc.log:utctime,pid,tags:filecount=32,filesize=64m -Djava.locale.providers=COMPAT -Dio.netty.allocator.type=unpooled -Des.path.home=/home/estestuser/elasticsearch-7.1.1 -Des.path.conf=/home/estestuser/elasticsearch-7.1.1/config -Des.distribution.flavor=default -Des.distribution.type=tar -Des.bundled_jdk=true -cp /home/estestuser/elasticsearch-7.1.1/lib/* org.elasticsearch.bootstrap.Elasticsearch -d
estestu+ 32017 31979 0 Feb23 ? 00:00:00 /home/estestuser/elasticsearch-7.1.1/modules/x-pack-ml/platform/linux-x86_64/bin/controller
[estestuser@vm-10-201-42-9 config]$ kill -9 31979
[estestuser@vm-10-201-42-9 config]$ ps -ef|grep elasticsearch
estestu+ 10406 8753 0 09:34 pts/0 00:00:00 grep --color=auto elasticsearch
[estestuser@vm-10-201-42-9 config]$ cd ../
[estestuser@vm-10-201-42-9 elasticsearch-7.1.1]$ bin/elasticsearch -d
Restart node 2 and node 3 in turn.
Fourth, create an Elasticsearch cluster password
Execute the following command on node 1 to set the user password. After setting, the data will be automatically synchronized to other nodes.
[estestuser@vm-10-201-42-9 elasticsearch-7.1.1]$ bin/elasticsearch-setup-passwords interactive
Initiating the setup of passwords for reserved users elastic,apm_system,kibana,logstash_system,beats_system,remote_monitoring_user.
You will be prompted to enter passwords as the process progresses.
Please confirm that you would like to continue [y/N]y
Enter password for [elastic]:
Reenter password for [elastic]:
Enter password for [apm_system]:
Reenter password for [apm_system]:
Enter password for [kibana]:
Reenter password for [kibana]:
Enter password for [logstash_system]:
Reenter password for [logstash_system]:
Enter password for [beats_system]:
Reenter password for [beats_system]:
Enter password for [remote_monitoring_user]:
Reenter password for [remote_monitoring_user]:
Changed password for user [apm_system]
Changed password for user [kibana]
Changed password for user [logstash_system]
Changed password for user [beats_system]
Changed password for user [remote_monitoring_user]
Changed password for user [elastic]
[estestuser@vm-10-201-42-9 elasticsearch-7.1.1]$
Five, access verification
I accessed elasticsearch again without a password, and found that it prompted a security authentication error.
[estestuser@vm-10-201-42-9 elasticsearch-7.1.1]$ curl http://localhost:9200
{
"error":{
"root_cause":[{
"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{
"WWW-Authenticate":"Basic realm=\"security\" charset=\"UTF-8\""}}],"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{
"WWW-Authenticate":"Basic realm=\"security\" charset=\"UTF-8\""}},"status":401}
Enter account number: elastic, password: testpassword (this password is not a real password, just for blogging records), visit again and find success.
[estestuser@vm-10-201-42-9 elasticsearch-7.1.1]$ curl --user elastic:testpassword http://localhost:9200
{
"name" : "node-1",
"cluster_name" : "my-application",
"cluster_uuid" : "l-kTWdoxRCuTIm6x8ekG7w",
"version" : {
"number" : "7.1.1",
"build_flavor" : "default",
"build_type" : "tar",
"build_hash" : "7a013de",
"build_date" : "2019-05-23T14:04:00.380842Z",
"build_snapshot" : false,
"lucene_version" : "8.0.0",
"minimum_wire_compatibility_version" : "6.8.0",
"minimum_index_compatibility_version" : "6.0.0-beta1"
},
"tagline" : "You Know, for Search"
}
The above access method is a plain text password input, which is not recommended. You can change to the following method to access.
[estestuser@vm-10-201-42-9 elasticsearch-7.1.1]$ curl --user elastic http://localhost:9200
Enter host password for user 'elastic':
{
"name" : "node-1",
"cluster_name" : "my-application",
"cluster_uuid" : "l-kTWdoxRCuTIm6x8ekG7w",
"version" : {
"number" : "7.1.1",
"build_flavor" : "default",
"build_type" : "tar",
"build_hash" : "7a013de",
"build_date" : "2019-05-23T14:04:00.380842Z",
"build_snapshot" : false,
"lucene_version" : "8.0.0",
"minimum_wire_compatibility_version" : "6.8.0",
"minimum_index_compatibility_version" : "6.0.0-beta1"
},
"tagline" : "You Know, for Search"
}
After verification, it is found that adding user security authentication to the cluster is successful.
Article reference: