在不安全的集群上启用 Elasticsearch Xpack 安全性

本博文详细描述如何把一个没有启动安全的 Elasticsearch 集群升级为一个带有 HTTPS 访问的启用 Elasticsearch xpack 安全的集群。

为了增强 Elasticsearch 集群的安全性，你需要执行完全集群重启，并在客户端进行一些更改。启用身份验证后，所有索引和搜索数据的请求都将需要用户名和密码或 token。

安装

如果你还不知道如何安装一个不含有安全的 Elasticsearch 8.x 集群，那么请参考之前的文章：

Elasticsearch：如何在 Docker 上运行 Elasticsearch 8.x 进行本地开发
Elastic Stack 8.0 安装 - 保护你的 Elastic Stack 现在比以往任何时候都简单（参考文章的 "如何配置 Elasticsearch 不带安全性" 部分）

在本显示中，我们将参考上面的第二篇文章在本地部署一个不带安全的 Elasticsearch 集群。在第一次启动 Elasticsearch 之前，我们必须修改 elasticsearch.yml 文件如下：

yaml 复制代码

1.  xpack.security.enabled: false
2.  xpack.security.http.ssl.enabled: false

只有这样的配置，我们才可以安装出一个没有任何安全的 Elasticsearch 集群。安装完毕后，我们可以在 http://localhost:9200 来访问 Elasticsearch 集群。

json 复制代码

1.  $ curl http://localhost:9200
2.  {
3.    "name" : "liuxgm.local",
4.    "cluster_name" : "elasticsearch",
5.    "cluster_uuid" : "hHUucYL9Q0GhcC9QivRlDg",
6.    "version" : {
7.      "number" : "8.10.0",
8.      "build_flavor" : "default",
9.      "build_type" : "tar",
10.      "build_hash" : "e338da74c79465dfdc204971e600342b0aa87b6b",
11.      "build_date" : "2023-09-07T08:16:21.960703010Z",
12.      "build_snapshot" : false,
13.      "lucene_version" : "9.7.0",
14.      "minimum_wire_compatibility_version" : "7.17.0",
15.      "minimum_index_compatibility_version" : "7.0.0"
16.    },
17.    "tagline" : "You Know, for Search"
18.  }

一旦安装完毕，我们在下面的步骤中来进行展示。

启动 xpack 安全

步骤：

创建 SSL Elastic 证书
将 SSL 证书复制到所有节点
更新 elasticsearch.yml
停止所有 Elasticsearch 节点
启动所有 Elasticsearch 节点
创建/重置内置用户密码

下面，我们分别进行展示各个步骤。

1. 创建 SSL Elastic 证书

要启用 TLS 通信，需要 SSL 证书。首先创建 SSL 证书。注意：只需创建一次证书并将其复制到所有节点。
创建 CA 证书。

css 复制代码

1.  ./bin/elasticsearch-certutil ca --days 3650
2.  [Press Enter]
3.  [Press Enter]

vbnet 复制代码

1.  $ pwd
2.  /Users/liuxg/test/elasticsearch-8.10.0
3.  $ ./bin/elasticsearch-certutil ca --days 3650
4.  This tool assists you in the generation of X.509 certificates and certificate
5.  signing requests for use with SSL/TLS in the Elastic stack.

7.  The 'ca' mode generates a new 'certificate authority'
8.  This will create a new X.509 certificate and private key that can be used
9.  to sign certificate when running in 'cert' mode.

11.  Use the 'ca-dn' option if you wish to configure the 'distinguished name'
12.  of the certificate authority

14.  By default the 'ca' mode produces a single PKCS#12 output file which holds:
15.      * The CA certificate
16.      * The CA's private key

18.  If you elect to generate PEM format certificates (the -pem option), then the output will
19.  be a zip file containing individual files for the CA certificate and private key

21.  Please enter the desired output file [elastic-stack-ca.p12]: 
22.  Enter password for elastic-stack-ca.p12 : 
23.  $ ls
24.  LICENSE.txt          bin                  elastic-stack-ca.p12 logs
25.  NOTICE.txt           config               jdk.app              modules
26.  README.asciidoc      data                 lib                  plugins

在上面，我们可以看到生产的 elastic-stack-ca.p12 文件。如果你是针对 Linux 的安装，那么你的证书必须是位于 /usr/share/elasticsearch 目录下。

在单个节点上，为集群中的所有节点生成证书和私钥。

css 复制代码

1.  ./bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12 --days 3650
2.  [Press Enter]
3.  [Press Enter]

vbnet 复制代码

1.  $ ./bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12 --days 3650
2.  This tool assists you in the generation of X.509 certificates and certificate
3.  signing requests for use with SSL/TLS in the Elastic stack.

5.  The 'cert' mode generates X.509 certificate and private keys.
6.      * By default, this generates a single certificate and key for use
7.         on a single instance.
8.      * The '-multiple' option will prompt you to enter details for multiple
9.         instances and will generate a certificate and key for each one
10.      * The '-in' option allows for the certificate generation to be automated by describing
11.         the details of each instance in a YAML file

13.      * An instance is any piece of the Elastic Stack that requires an SSL certificate.
14.        Depending on your configuration, Elasticsearch, Logstash, Kibana, and Beats
15.        may all require a certificate and private key.
16.      * The minimum required value for each instance is a name. This can simply be the
17.        hostname, which will be used as the Common Name of the certificate. A full
18.        distinguished name may also be used.
19.      * A filename value may be required for each instance. This is necessary when the
20.        name would result in an invalid file or directory name. The name provided here
21.        is used as the directory name (within the zip) and the prefix for the key and
22.        certificate files. The filename is required if you are prompted and the name
23.        is not displayed in the prompt.
24.      * IP addresses and DNS names are optional. Multiple values can be specified as a
25.        comma separated string. If no IP addresses or DNS names are provided, you may
26.        disable hostname verification in your SSL configuration.

29.      * All certificates generated by this tool will be signed by a certificate authority (CA)
30.        unless the --self-signed command line option is specified.
31.        The tool can automatically generate a new CA for you, or you can provide your own with
32.        the --ca or --ca-cert command line options.

35.  By default the 'cert' mode produces a single PKCS#12 output file which holds:
36.      * The instance certificate
37.      * The private key for the instance certificate
38.      * The CA certificate

40.  If you specify any of the following options:
41.      * -pem (PEM formatted output)
42.      * -multiple (generate multiple certificates)
43.      * -in (generate certificates from an input file)
44.  then the output will be be a zip file containing individual certificate/key files

46.  Enter password for CA (elastic-stack-ca.p12) : 
47.  Please enter the desired output file [elastic-certificates.p12]: 
48.  Enter password for elastic-certificates.p12 : 

50.  Certificates written to /Users/liuxg/test/elasticsearch-8.10.0/elastic-certificates.p12

52.  This file should be properly secured as it contains the private key for 
53.  your instance.
54.  This file is a self contained file and can be copied and used 'as is'
55.  For each Elastic product that you wish to configure, you should copy
56.  this '.p12' file to the relevant configuration directory
57.  and then follow the SSL configuration instructions in the product guide.

59.  For client applications, you may only need to copy the CA certificate and
60.  configure the client to trust this certificate.
61.  $ ls
62.  LICENSE.txt              data                     logs
63.  NOTICE.txt               elastic-certificates.p12 modules
64.  README.asciidoc          elastic-stack-ca.p12     plugins
65.  bin                      jdk.app
66.  config                   lib

从上面的输出中我们可以看出来有一个新的文件 elastic-certificates.p12 被生成。

2. 拷贝 SSL 证书到所有的节点

针对子家压缩包进行安装的 Elasticsearch 来说，我们可以把刚生产的证书拷贝到相应的 config 目录下：

bash 复制代码

1.  $ pwd
2.  /Users/liuxg/test/elasticsearch-8.10.0
3.  $ cp elastic-certificates.p12 config/

针对 Linux 环境，我们可以使用如下的命令来进行拷贝。必须在 "/usr/share/elasticsearch" 下创建 "elastic-certificates.p12" 文件。创建 SSL 证书 (elastic-certificates.p12) 后，将其复制并粘贴到所有节点上。

bash 复制代码

1.  mv /usr/share/elasticsearch/elastic-certificates.p12 /etc/elasticsearch/
2.  chown elasticsearch:elasticsearch /etc/elasticsearch/ -R

3. 更新 elasticsearch.yml 文件

编辑 elasticsearch.yml 文件并添加或更新以下设置：

yaml 复制代码

1.  xpack.security.enabled: true
2.  xpack.security.transport.ssl.enabled: true
3.  xpack.security.transport.ssl.verification_mode: certificate
4.  xpack.security.transport.ssl.client_authentication: required
5.  xpack.security.transport.ssl.keystore.path: elastic-certificates.p12
6.  xpack.security.transport.ssl.truststore.path: elastic-certificates.p12

8.  xpack.security.http.ssl:
9.    enabled: true
10.    keystore.path: elastic-certificates.p12

如果你是按照本教程安装的没有设置任何安全的 Elasticsearch 集群，那么请删之前在安装时的如下两行，再进行粘贴上面的代码：

注意：证书的默认路径是 "/etc/elasticsearch/elastic-certificates.p12"。还有：确保没有重复设置。

4. 停止所有的 Elasticsearch 节点

Linux：

arduino 复制代码

service elasticsearch stop

如果是字节压缩的安装，你可以使用 Ctrl + C 来终止集群的运行。

5. 启动所有 Elasticsearch 节点

从主节点开始，启动所有 Elasticsearch 节点。

Linux:

sql 复制代码

service elasticsearch start

针对自解压的安装，你可以使用:

bash 复制代码

./bin/elasticsearch

从主节点开始可确保 Elasticsearch 集群的核心在数据节点上线之前启动并运行。此顺序对于维护集群稳定性和数据完整性非常重要。

6. 创建/重置内置用户密码

bash 复制代码

bin/elasticsearch-reset-password -u -i elastic

markdown 复制代码

1.  $ pwd
2.  /Users/liuxg/test/elasticsearch-8.10.0
3.  $ ./bin/elasticsearch-setup-passwords interactive
4.  ******************************************************************************
5.  Note: The 'elasticsearch-setup-passwords' tool has been deprecated. This       command will be removed in a future release.
6.  ******************************************************************************

8.  Initiating the setup of passwords for reserved users elastic,apm_system,kibana,kibana_system,logstash_system,beats_system,remote_monitoring_user.
9.  You will be prompted to enter passwords as the process progresses.
10.  Please confirm that you would like to continue [y/N]y

13.  Enter password for [elastic]: 
14.  Reenter password for [elastic]: 
15.  Enter password for [apm_system]: 
16.  Reenter password for [apm_system]: 
17.  Enter password for [kibana_system]: 
18.  Reenter password for [kibana_system]: 
19.  Enter password for [logstash_system]: 
20.  Reenter password for [logstash_system]: 
21.  Enter password for [beats_system]: 
22.  Reenter password for [beats_system]: 
23.  Enter password for [remote_monitoring_user]: 
24.  Reenter password for [remote_monitoring_user]: 
25.  Changed password for user [apm_system]
26.  Changed password for user [kibana_system]
27.  Changed password for user [kibana]
28.  Changed password for user [logstash_system]
29.  passwordChanged password for user [beats_system]
30.  Changed password for user [remote_monitoring_user]
31.  Changed password for user [elastic]

为方便说明，我们在上面把密码都设置为 "password"。

7. 测试

我们使用如下的命令来进行测试：

arduino 复制代码

curl -k -u elastic:password  https://localhost:9200

json 复制代码

1.  $ curl -k -u elastic:password  https://localhost:9200
2.  {
3.    "name" : "liuxgm.local",
4.    "cluster_name" : "elasticsearch",
5.    "cluster_uuid" : "hHUucYL9Q0GhcC9QivRlDg",
6.    "version" : {
7.      "number" : "8.10.0",
8.      "build_flavor" : "default",
9.      "build_type" : "tar",
10.      "build_hash" : "e338da74c79465dfdc204971e600342b0aa87b6b",
11.      "build_date" : "2023-09-07T08:16:21.960703010Z",
12.      "build_snapshot" : false,
13.      "lucene_version" : "9.7.0",
14.      "minimum_wire_compatibility_version" : "7.17.0",
15.      "minimum_index_compatibility_version" : "7.0.0"
16.    },
17.    "tagline" : "You Know, for Search"
18.  }

常见问题及解决方案：

SSL 证书路径：确保 "elastic-certificates.p12" 路径正确。在 Debian 或 RPM 安装中，默认路径是 "/etc/elasticsearch"。
SSL 证书权限：验证所有 Elasticsearch 节点是否具有 SSL 证书和足够的访问权限。
SSL 证书密码：在证书创建过程中，未定义密码，但 Elasticsearch v8 可能有默认密码。检查 "./bin/elasticsearch-keystore list" 并删除为"xpack.security.transport.ssl.*"定义的任何密码。
Elasticsearch-Reset-Password 命令（1）：确保您可以通过 localhost 访问 Elasticsearch。如果没有，请在命令末尾添加 "---url"。检查是否有任何代理问题。
Elasticsearch-Reset-Password命令（2）：该命令需要数据节点连接到集群，因为它需要将 elastic 用户密码添加到 '.security' 索引中。在运行命令之前确保数据节点已连接。
Kibana 不工作：Elasticsearch v8 之后，你无法在 Kibana 中使用 elastic 超级用户。使用 "kibana_system" 用户。
Kibana 系统无法登录：使用 elastic 用户登录 Kibana； "kibana_system" 用户保留用于 Kibana 和 Elasticsearch 之间的通信。

更多阅读：Security：如何安装 Elastic SIEM 和 EDR