前のブログ「ElasticSearchクラスターを構築する方法は？》 ESクラスターを構築する手順の概要この記事では、ユーザーセキュリティ認証をESクラスターに追加する方法、つまりESクラスターのアクセスパスワードを設定する方法を要約します。
6.8より前の無料バージョンにはセキュリティ認証機能が含まれていませんでしたが、それ以降のバージョンでは、通常のユーザーには十分な基本認証機能がいくつか開かれています。セキュリティ上の理由から、アクセスパスワードは通常、ハッカーがサーバーのログインパスワードを解読して、サーバー上のESデータを取得することを防ぐために設定されます。前のブログで構築されたクラスターに基づいて、次の手順を追加して、ユーザーセキュリティ認証機能を完了します。
1.新しい構成。各クラスターノードを設定する必要があります。
elasticsearch.ymlファイルを編集します。
[estestuser@vm-10-201-42-9 config]$ vi elasticsearch.yml
次のコンテンツを追加します。
xpack.security.enabled: true
xpack.license.self_generated.type: basic
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: elastic-certificates.p12
ノード2とノード3でそれぞれ上記の変更を行います。
2. TLSとID検証を生成します。elastic-certificates.p12ファイルはconfigの下に生成され、このファイルを他の2つのノードのconfigディレクトリに転送し、ファイルのアクセス許可に注意します。
[estestuser@vm-10-201-42-9 elasticsearch-7.1.1]$ bin/elasticsearch-certutil cert -out config/elastic-certificates.p12 -pass ""
WARNING: An illegal reflective access operation has occurred
WARNING: Illegal reflective access by org.bouncycastle.jcajce.provider.drbg.DRBG (file:/home/estestuser/elasticsearch-7.1.1/lib/tools/security-cli/bcprov-jdk15on-1.61.jar) to constructor sun.security.provider.Sun()
WARNING: Please consider reporting this to the maintainers of org.bouncycastle.jcajce.provider.drbg.DRBG
WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
WARNING: All illegal access operations will be denied in a future release
This tool assists you in the generation of X.509 certificates and certificate
signing requests for use with SSL/TLS in the Elastic stack.
The 'cert' mode generates X.509 certificate and private keys.
* By default, this generates a single certificate and key for use
on a single instance.
* The '-multiple' option will prompt you to enter details for multiple
instances and will generate a certificate and key for each one
* The '-in' option allows for the certificate generation to be automated by describing
the details of each instance in a YAML file
* An instance is any piece of the Elastic Stack that requires a SSL certificate.
Depending on your configuration, Elasticsearch, Logstash, Kibana, and Beats
may all require a certificate and private key.
* The minimum required value for each instance is a name. This can simply be the
hostname, which will be used as the Common Name of the certificate. A full
distinguished name may also be used.
* A filename value may be required for each instance. This is necessary when the
name would result in an invalid file or directory name. The name provided here
is used as the directory name (within the zip) and the prefix for the key and
certificate files. The filename is required if you are prompted and the name
is not displayed in the prompt.
* IP addresses and DNS names are optional. Multiple values can be specified as a
comma separated string. If no IP addresses or DNS names are provided, you may
disable hostname verification in your SSL configuration.
* All certificates generated by this tool will be signed by a certificate authority (CA).
* The tool can automatically generate a new CA for you, or you can provide your own with the
-ca or -ca-cert command line options.
By default the 'cert' mode produces a single PKCS#12 output file which holds:
* The instance certificate
* The private key for the instance certificate
* The CA certificate
If you specify any of the following options:
* -pem (PEM formatted output)
* -keep-ca-key (retain generated CA key)
* -multiple (generate multiple certificates)
* -in (generate certificates from an input file)
then the output will be be a zip file containing individual certificate/key files
Certificates written to /home/estestuser/elasticsearch-7.1.1/config/elastic-certificates.p12
This file should be properly secured as it contains the private key for
your instance.
This file is a self contained file and can be copied and used 'as is'
For each Elastic product that you wish to configure, you should copy
this '.p12' file to the relevant configuration directory
and then follow the SSL configuration instructions in the product guide.
上記の操作が完了すると、以下に示すように、構成パスの下に証明書elastic-certificates.p12が生成されます。
[estestuser@vm-10-201-42-9 elasticsearch-7.1.1]$ cd config/
[estestuser@vm-10-201-42-9 config]$ ll
total 48
-rw------- 1 estestuser estestuser 3443 Feb 24 09:31 elastic-certificates.p12
-rw-rw---- 1 estestuser estestuser 199 Feb 23 15:45 elasticsearch.keystore
-rw-rw---- 1 estestuser estestuser 3244 Feb 24 09:27 elasticsearch.yml
-rw-rw---- 1 estestuser estestuser 3544 Feb 23 16:15 jvm.options
-rw-rw---- 1 estestuser estestuser 17170 May 23 2019 log4j2.properties
-rw-rw---- 1 estestuser estestuser 473 May 23 2019 role_mapping.yml
-rw-rw---- 1 estestuser estestuser 197 May 23 2019 roles.yml
-rw-rw---- 1 estestuser estestuser 0 May 23 2019 users
-rw-rw---- 1 estestuser estestuser 0 May 23 2019 users_roles
ノード1の証明書を他のノードに順番にコピーします。
[estestuser@vm-10-201-42-9 config]$ scp elastic-certificates.p12 estestuser@10.201.42.19:/home/estestuser/elasticsearch-7.1.1/config/
estestuser@10.201.42.19's password:
elastic-certificates.p12 100% 3443 2.8MB/s 00:00
[estestuser@vm-10-201-42-9 config]$ scp elastic-certificates.p12 [email protected]:/home/estestuser/elasticsearch-7.1.1/config/
[email protected]'s password:
elastic-certificates.p12 100% 3443 3.1MB/s 00:00
3、ESクラスターを再起動します
ESクラスタが起動せず、以下のパスワード追加操作ができないため、3ノードを順番に再起動してください。最初にノード1を再起動します。
[estestuser@vm-10-201-42-9 config]$ ps -ef|grep elasticsearch
estestu+ 10370 8753 0 09:34 pts/0 00:00:00 grep --color=auto elasticsearch
estestu+ 31979 1 0 Feb23 ? 00:02:21 /home/estestuser/elasticsearch-7.1.1/jdk/bin/java -Xms1g -Xmx1g -XX:+UseParallelGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -Des.networkaddress.cache.ttl=60 -Des.networkaddress.cache.negative.ttl=10 -XX:+AlwaysPreTouch -Xss1m -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djna.nosys=true -XX:-OmitStackTraceInFastThrow -Dio.netty.noUnsafe=true -Dio.netty.noKeySetOptimization=true -Dio.netty.recycler.maxCapacityPerThread=0 -Dlog4j.shutdownHookEnabled=false -Dlog4j2.disable.jmx=true -Djava.io.tmpdir=/tmp/elasticsearch-2970892740801116994 -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=data -XX:ErrorFile=logs/hs_err_pid%p.log -Xlog:gc*,gc+age=trace,safepoint:file=logs/gc.log:utctime,pid,tags:filecount=32,filesize=64m -Djava.locale.providers=COMPAT -Dio.netty.allocator.type=unpooled -Des.path.home=/home/estestuser/elasticsearch-7.1.1 -Des.path.conf=/home/estestuser/elasticsearch-7.1.1/config -Des.distribution.flavor=default -Des.distribution.type=tar -Des.bundled_jdk=true -cp /home/estestuser/elasticsearch-7.1.1/lib/* org.elasticsearch.bootstrap.Elasticsearch -d
estestu+ 32017 31979 0 Feb23 ? 00:00:00 /home/estestuser/elasticsearch-7.1.1/modules/x-pack-ml/platform/linux-x86_64/bin/controller
[estestuser@vm-10-201-42-9 config]$ kill -9 31979
[estestuser@vm-10-201-42-9 config]$ ps -ef|grep elasticsearch
estestu+ 10406 8753 0 09:34 pts/0 00:00:00 grep --color=auto elasticsearch
[estestuser@vm-10-201-42-9 config]$ cd ../
[estestuser@vm-10-201-42-9 elasticsearch-7.1.1]$ bin/elasticsearch -d
ノード2とノード3を順番に再起動します。
第4に、Elasticsearchクラスターのパスワードを作成します
ノード1で次のコマンドを実行して、ユーザーパスワードを設定します。設定後、データは自動的に他のノードに同期されます。
[estestuser@vm-10-201-42-9 elasticsearch-7.1.1]$ bin/elasticsearch-setup-passwords interactive
Initiating the setup of passwords for reserved users elastic,apm_system,kibana,logstash_system,beats_system,remote_monitoring_user.
You will be prompted to enter passwords as the process progresses.
Please confirm that you would like to continue [y/N]y
Enter password for [elastic]:
Reenter password for [elastic]:
Enter password for [apm_system]:
Reenter password for [apm_system]:
Enter password for [kibana]:
Reenter password for [kibana]:
Enter password for [logstash_system]:
Reenter password for [logstash_system]:
Enter password for [beats_system]:
Reenter password for [beats_system]:
Enter password for [remote_monitoring_user]:
Reenter password for [remote_monitoring_user]:
Changed password for user [apm_system]
Changed password for user [kibana]
Changed password for user [logstash_system]
Changed password for user [beats_system]
Changed password for user [remote_monitoring_user]
Changed password for user [elastic]
[estestuser@vm-10-201-42-9 elasticsearch-7.1.1]$
5、アクセス検証
パスワードなしでelasticsearchに再度アクセスしたところ、セキュリティ認証エラーが発生したことがわかりました。
[estestuser@vm-10-201-42-9 elasticsearch-7.1.1]$ curl http://localhost:9200
{
"error":{
"root_cause":[{
"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{
"WWW-Authenticate":"Basic realm=\"security\" charset=\"UTF-8\""}}],"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{
"WWW-Authenticate":"Basic realm=\"security\" charset=\"UTF-8\""}},"status":401}
アカウント番号：elastic、パスワード：testpassword（このパスワードは実際のパスワードではありません。ブログの記録のためだけです）を入力し、もう一度アクセスして成功を見つけてください。
[estestuser@vm-10-201-42-9 elasticsearch-7.1.1]$ curl --user elastic:testpassword http://localhost:9200
{
"name" : "node-1",
"cluster_name" : "my-application",
"cluster_uuid" : "l-kTWdoxRCuTIm6x8ekG7w",
"version" : {
"number" : "7.1.1",
"build_flavor" : "default",
"build_type" : "tar",
"build_hash" : "7a013de",
"build_date" : "2019-05-23T14:04:00.380842Z",
"build_snapshot" : false,
"lucene_version" : "8.0.0",
"minimum_wire_compatibility_version" : "6.8.0",
"minimum_index_compatibility_version" : "6.0.0-beta1"
},
"tagline" : "You Know, for Search"
}
上記のアクセス方法はプレーンテキストのパスワード入力であるため、お勧めしません。次の方法に変更してアクセスできます。
[estestuser@vm-10-201-42-9 elasticsearch-7.1.1]$ curl --user elastic http://localhost:9200
Enter host password for user 'elastic':
{
"name" : "node-1",
"cluster_name" : "my-application",
"cluster_uuid" : "l-kTWdoxRCuTIm6x8ekG7w",
"version" : {
"number" : "7.1.1",
"build_flavor" : "default",
"build_type" : "tar",
"build_hash" : "7a013de",
"build_date" : "2019-05-23T14:04:00.380842Z",
"build_snapshot" : false,
"lucene_version" : "8.0.0",
"minimum_wire_compatibility_version" : "6.8.0",
"minimum_index_compatibility_version" : "6.0.0-beta1"
},
"tagline" : "You Know, for Search"
}
検証後、クラスターへのユーザーセキュリティ認証の追加が成功したことがわかります。
記事の参照：