码迷，mamicode.com
首页 > 其他好文 > 详细

ELK之ElasticSearch 6.4.x安全认证Search Guard6

时间：2018-09-28 20:50:36      阅读：640      评论：0      收藏：0      [点我收藏+]

标签：ofo   loader   文档   runtime   name   from   location   read   设置权限   

ELK的安装非常简单，解压稍加配置即能用。

今天的重点是记录ELK的安全认证，ELK安装好后，ElasticSearch是可以直接浏览访问的，非常不安全，Kibana也是一样直接访问web界面无需密码。

这里使用的是开源免费社区版：Search Guard 6插件来做安全认证。

  1. 软件版本与环境

ElasticSearch集群3台
10.1.1.195 elasticsearch logstash
10.1.1.196 elasticsearch
10.1.1.197 elasticsearch kibana

ELK版本：
elasticsearch-6.4.0
logstash-6.4.0
kibana-6.4.0
JDK1.8

下载地址：https://www.elastic.co/downloads
E：https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.4.0.tar.gz
L：https://artifacts.elastic.co/downloads/logstash/logstash-6.4.0.zip
K：https://artifacts.elastic.co/downloads/kibana/kibana-6.4.0-linux-x86_64.tar.gz

JDK1.8：https://www.oracle.com/technetwork/java/javase/downloads/jdk8-downloads-2133151.html

Search Guard版本必须要和elasticsearch，kibana版本对应 :https://docs.search-guard.com/latest/search-guard-versions
Search Guard 6-6.4.0
elasticsearch安装的Search Guard版本：search-guard-6-6.4.0-23.1
https://oss.sonatype.org/service/local/repositories/releases/content/com/floragunn/search-guard-6/6.4.0-23.1/search-guard-6-6.4.0-23.1.zip
kibana安装的Search Guard版本：search-guard-kibana-plugin-6.4.0-15
https://oss.sonatype.org/service/local/repositories/releases/content/com/floragunn/search-guard-kibana-plugin/6.4.0-15/search-guard-kibana-plugin-6.4.0-15.zip

  1. 在线生成Search Guard证书
    Search Guard需要证书才可以，生成证书有两种方式，一个是人工手动生成，这个复杂麻烦，另一种就是官网提供了在线生成，这里使用了后面一种在线生成
    官网在线生成证书连接：https://search-guard.com/tls-certificate-generator/
    技术分享图片
    Email用来接收密钥，
    Organization Name可以随便填写，
    Hostname填写ElasticSearch集群中每个节点的node name，这是一一对应的，这里我有三个节点，
    node name为填节点IP

将邮箱中收到的密钥文件上传至服务器/tmp路径，再解压，会得到search-guard-certificates文件夹。
结构如下：

# tree /tmp/search-guard-certificates
/tmp/search-guard-certificates
├── chain-ca.pem
├── client-certificates
│   ├── CN=demouser.all.pem
│   ├── CN=demouser.crtfull.pem
│   ├── CN=demouser.crt.pem
│   ├── CN=demouser.csr
│   ├── CN=demouser.key.pem
│   ├── CN=demouser.key.pkcs12
│   ├── CN=demouser-keystore.jks
│   ├── CN=demouser-keystore.p12
│   ├── CN=demouser-signed.pem
│   ├── CN=sgadmin.all.pem
│   ├── CN=sgadmin.crtfull.pem
│   ├── CN=sgadmin.crt.pem
│   ├── CN=sgadmin.csr
│   ├── CN=sgadmin.key.pem
│   ├── CN=sgadmin.key.pkcs12
│   ├── CN=sgadmin-keystore.jks
│   ├── CN=sgadmin-keystore.p12
│   └── CN=sgadmin-signed.pem
├── node-certificates
│   ├── CN=IP-10.1.1.195.crtfull.pem
│   ├── CN=IP-10.1.1.195.csr
│   ├── CN=IP-10.1.1.195.key.pem
│   ├── CN=IP-10.1.1.195.key.pkcs12
│   ├── CN=IP-10.1.1.195-keystore.jks
│   ├── CN=IP-10.1.1.195-keystore.p12
│   ├── CN=IP-10.1.1.195-signed.pem
│   ├── CN=IP-10.1.1.196.crtfull.pem
│   ├── CN=IP-10.1.1.196.csr
│   ├── CN=IP-10.1.1.196.key.pem
│   ├── CN=IP-10.1.1.196.key.pkcs12
│   ├── CN=IP-10.1.1.196-keystore.jks
│   ├── CN=IP-10.1.1.196-keystore.p12
│   ├── CN=IP-10.1.1.196-signed.pem
│   ├── CN=IP-10.1.1.197.crtfull.pem
│   ├── CN=IP-10.1.1.197.csr
│   ├── CN=IP-10.1.1.197.key.pem
│   ├── CN=IP-10.1.1.197.key.pkcs12
│   ├── CN=IP-10.1.1.197-keystore.jks
│   ├── CN=IP-10.1.1.197-keystore.p12
│   └── CN=IP-10.1.1.197-signed.pem
├── README.txt
├── root-ca
│   ├── root-ca.crt
│   ├── root-ca.key
│   └── root-ca.pem
├── root-ca.pem
├── signing-ca
│   ├── signing-ca.crt
│   ├── signing-ca.key
│   └── signing-ca.pem
├── truststore.jks
└── truststore.p12

4 directories, 50 files
  1. 安装配置search集群和Search Guard插件
    将前面下载的elasticsearch-6.4.0.tar.gz，和search-guard-6-6.4.0-23.1.zip上传至服务器/tmp目录

1）先安装elasticsearch

# tar zxvf elasticsearch-6.4.0.tar.gz -C /usr/local
# cd /usr/local/
# mv elasticsearch-6.4.0  ./elasticsearch

2）安装search-guard插件
官方提供的文档：https://docs.search-guard.com/latest/search-guard-installation

# cd /usr/local/elasticsearch
# ./bin/elasticsearch-plugin install -b file:///tmp/search-guard-6-6.4.0-23.1.zip
-> Downloading com.floragunn:search-guard-6:6.4.0-23.0 from maven central
[=================================================] 100%
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@     WARNING: plugin requires additional permissions     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
* java.io.FilePermission /proc/sys/net/core/somaxconn read
* java.lang.RuntimePermission accessClassInPackage.com.sun.jndi.ldap
* java.lang.RuntimePermission accessClassInPackage.sun.misc
* java.lang.RuntimePermission accessClassInPackage.sun.nio.ch
* java.lang.RuntimePermission accessClassInPackage.sun.security.x509
* java.lang.RuntimePermission accessDeclaredMembers
* java.lang.RuntimePermission accessUserInformation
* java.lang.RuntimePermission getClassLoader
* java.lang.RuntimePermission setContextClassLoader
* java.lang.RuntimePermission shutdownHooks
* java.lang.reflect.ReflectPermission suppressAccessChecks
* java.net.NetPermission getNetworkInformation
* java.net.NetPermission getProxySelector
* java.net.SocketPermission * connect,accept,resolve
* java.security.SecurityPermission getProperty.ssl.KeyManagerFactory.algorithm
* java.security.SecurityPermission insertProvider.BC
* java.security.SecurityPermission org.apache.xml.security.register
* java.security.SecurityPermission putProviderProperty.BC
* java.security.SecurityPermission setProperty.ocsp.enable
* java.util.PropertyPermission * read,write
* java.util.PropertyPermission org.apache.xml.security.ignoreLineBreaks write
* javax.security.auth.AuthPermission doAs
* javax.security.auth.AuthPermission modifyPrivateCredentials
* javax.security.auth.kerberos.ServicePermission * accept
See http://docs.oracle.com/javase/8/docs/technotes/guides/security/permissions.html
for descriptions of what these permissions allow and the associated risks.
-> Installed search-guard-6

3）将search-guard语言配置在elasticsearch.yml

# cd /usr/local/elasticsearch
--将第2步解压的证书文件夹/tmp/search-guard-certificates 复制到/usr/local/elasticsearch/config目录下
# cp -ar /tmp/search-guard-certificates  /usr/local/elasticsearch/config/key

--配置elasticsearch.yml
# egrep -v "^#|^$" ./config/elasticsearch.yml
cluster.name: CLU-ELK                      --集群名称
node.name: 10.1.1.195                       --节点名称
path.data: /data/elasticsearch/data     --数据存放路径
path.logs: /data/elasticsearch/logs      --日志存放路径
network.host: 0.0.0.0                           --监听ip
http.port: 9200                                     --监听端口
discovery.zen.ping.unicast.hosts: ["10.1.1.195", "10.1.1.196", "10.1.1.197"]             --集群节点
discovery.zen.minimum_master_nodes: 2                                                                 --最多几个有效节点
bootstrap.system_call_filter: false
searchguard.ssl.transport.pemcert_filepath: key/node-certificates/CN=IP-10.1.1.195.crtfull.pem   --search-guard节点证书，不同的节点填写成对应的证书
searchguard.ssl.transport.pemkey_filepath: key/node-certificates/CN=IP-10.1.1.195.key.pem       --search-guard节点key
searchguard.ssl.transport.pemkey_password: 701159a9c1a77ffd008d                                           --该密钥可在解压的证书文件夹下的README.txt里可查到
searchguard.ssl.transport.pemtrustedcas_filepath: key/chain-ca.pem
searchguard.ssl.transport.enforce_hostname_verification: false
searchguard.ssl.http.enabled: true
searchguard.ssl.http.pemcert_filepath: key/node-certificates/CN=IP-10.1.1..195.crtfull.pem
searchguard.ssl.http.pemkey_filepath: key/node-certificates/CN=IP-10.1.1..195.key.pem
searchguard.ssl.http.pemkey_password: 701159a9c1a77ffd008d
searchguard.ssl.http.pemtrustedcas_filepath: key/chain-ca.pem
searchguard.authcz.admin_dn:
  - CN=sgadmin
searchguard.audit.type: internal_elasticsearch
searchguard.enable_snapshot_restore_privilege: true
searchguard.check_snapshot_restore_write_privileges: true
searchguard.restapi.roles_enabled: ["sg_all_access"]
cluster.routing.allocation.disk.threshold_enabled: false
node.max_local_storage_nodes: 3
xpack.security.enabled: false

备：上面pemkey_password属性可以在下载的密钥包中README.txt文件中查看到

# tail -30 /usr/local/elasticsearch/key/README.txt

## Passwords

### Common passwords

Root CA password: fbb188de616ae59b17b424c4339b8333f0bdd8b6
Truststore password: 88e0e8b9fe8029ef7e07
Admin keystore and private key password: 00fb1075cf84c333f1cc
Demouser keystore and private key password: 4682ae98bd089f0be252

## Host/Node specific passwords

Host: 10.1.1.195
10.1.1.195 keystore and private key password: 43ccf85767e1232f6336        --每个节点的密钥
10.1.1.195 keystore: node-certificates/CN=10.88.6.195-keystore.jks
10.1.1.195 PEM certificate: node-certificates/CN=10.88.6.195.crtfull.pem
10.1.1.195 PEM private key: node-certificates/CN=10.88.6.195.key.pem

Host: 10.1.1.196
10.1.1.196 keystore and private key password: 712aae762adca2b981eb
10.1.1.196 keystore: node-certificates/CN=10.88.6.196-keystore.jks
10.1.1.196 PEM certificate: node-certificates/CN=10.88.6.196.crtfull.pem
10.1.1.196 PEM private key: node-certificates/CN=10.88.6.196.key.pem

Host: 10.1.1.197
10.1.1.197 keystore and private key password: 701159a9c1a77ffd008d
10.1.1.197 keystore: node-certificates/CN=10.88.6.197-keystore.jks
10.1.1.197 PEM certificate: node-certificates/CN=10.88.6.197.crtfull.pem
10.1.1.197 PEM private key: node-certificates/CN=10.88.6.197.key.pem

至此配置完成
接下来创建普通用户并启动elasticsearch

# useradd elk
# echo elk123 | passwd --stdin  elk
# chown elk:elk -R /usr/local/elasticsearch

启动elasticsearch，如果没有报错，就继续往下走，如果报错，则仔细检查每一步。

  1. 设置权限因子
    将sgadmin客户端证书密钥复制到插件目录下 
    # cd /usr/local/elasticsearch/config/key
# cp root-ca.pem chain-ca.pem  client-certificates/CN\=sgadmin.key.pem  client-certificates/CN\=sgadmin.crtfull.pem  ../../plugins/search-guard-6/tools 
# chmod 744 sgadmin.sh
# ./sgadmin.sh -cacert root-ca.pem -cert CN=sgadmin.crtfull.pem -key CN=sgadmin.key.pem -keypass 00fb1075cf84c333f1cc -nhnv -icl -cd ../sgconfig/
-nhnv -icl -cd ../sgconfig/
Search Guard Admin v6
Will connect to localhost:9300 ... done
Elasticsearch Version: 6.4.0
Search Guard Version: 6.4.0-23.1
Connected as CN=sgadmin
Contacting elasticsearch cluster ‘elasticsearch‘ and wait for YELLOW clusterstate ...
Clustername: GHS-ELK
Clusterstate: GREEN
Number of nodes: 3
Number of data nodes: 3
searchguard index already exists, so we do not need to create one.
Populate config from /usr/local/elasticsearch/plugins/search-guard-6/sgconfig
Will update ‘sg/config‘ with ../sgconfig/sg_config.yml
SUCC: Configuration for ‘config‘ created or updated
Will update ‘sg/roles‘ with ../sgconfig/sg_roles.yml
SUCC: Configuration for ‘roles‘ created or updated
Will update ‘sg/rolesmapping‘ with ../sgconfig/sg_roles_mapping.yml
SUCC: Configuration for ‘rolesmapping‘ created or updated
Will update ‘sg/internalusers‘ with ../sgconfig/sg_internal_users.yml
SUCC: Configuration for ‘internalusers‘ created or updated
Will update ‘sg/actiongroups‘ with ../sgconfig/sg_action_groups.yml
SUCC: Configuration for ‘actiongroups‘ created or updated
Done with success

备：权限因子执行命令，在下载的key证书目录下的README.txt里可以找到

浏览器书打开验证是否生效https://admin:admin@10.1.1.195:9200 

ip  heap.percent ram.percent cpu load_1m load_5m load_15m node.role master name
10.1.1.197           37          14   0    0.51    0.23     0.23 mdi       -      10.1.1.197
10.1.1.196           29          10   0    0.14    0.09     0.12 mdi       *      10.1.1.196
10.1.1.195           33          16   5    0.19    0.30     0.31 mdi       -      10.1.1.195

如看到此结果说明账户配置成功，其admin:admin是默认管理账户。关于帐号，会在后面配置kibana章节说到

这是第一章节，讲elasticsearch 6.4.0 部署search-guard 6的方法

下一章节讲logstash 配置search-guard 6的方法，以级认证的方法

ELK之ElasticSearch 6.4.x安全认证Search Guard6

标签：ofo   loader   文档   runtime   name   from   location   read   设置权限   

原文地址：http://blog.51cto.com/passed/2287142
踩
(0)
赞
(0)
   
举报
评论 一句话评论（0）
登录后才能评论！
分享档案
更多>
2021年07月29日 (22)
2021年07月28日 (40)
2021年07月27日 (32)
2021年07月26日 (79)
2021年07月23日 (29)
2021年07月22日 (30)
2021年07月21日 (42)
2021年07月20日 (16)
2021年07月19日 (90)
2021年07月16日 (35)
周排行
mamicode.com排行更多图片
更多
友情链接
兰亭集智   国之画   百度统计   站长统计   阿里云   chrome插件   新版天听网
关于我们 - 联系我们 - 留言反馈
© 2014 mamicode.com 版权所有  联系我们:gaon5@hotmail.com
迷上了代码！