安全通信设置：使用 OpenSSL 为 Logstash 和 Filebeat 提供 SSL 证书

Elastic 中国社区官方博客2024-02-03 12:05

在为 Elasticsearch 采集数据时，我们经常使用到 Filebeat 及 Logstash。在我们之前的很多教程中，我们通常不为 Filebeat 和 Logstash 之前的通信做安全配置。

如何为 Filebeat 及 Logstash 直接建立安全的链接？这个在很多的情况下是非常有用的。在我之前的文章 "Elasticsearch：为日志分析设置安全的 Elasticsearch 管道"，我有涉及到这个问题。最主要的是，它是针对 Elastic Stack 8.x 而设计的。在今天的文章中，我将针对最普通的情况来进行展示。

本指南提供了有关使用 OpenSSL 生成和配置 SSL 证书的详细说明，以增强 Logstash 和 Filebeat 之间通信的安全性。 概述的步骤包括为证书颁发机构 (CA) 生成私钥、为 CA 创建自签名 X509 证书以及为 Logstash 和 Filebeat 生成密钥和证书。 还包括使用这些证书的 Filebeat 和 Logstash 的配置步骤。

为 CA 生成私钥

# Generate a private key for the Certificate Authority (CA)
openssl genrsa 2048 > /path/to/your/ca-key.pem

$ pwd
/Users/liuxg/demos/filebeat_logstash
$ openssl genrsa 2048 > ca-key.pem
$ ls
ca-key.pem

为 CA 生成 X509 证书

# Generate a self-signed X509 certificate for the CA
openssl req -new -x509 -nodes -days 365000 \
    -key /path/to/your/ca-key.pem \
    -out /path/to/your/ca-cert.pem

openssl req -new -x509 -nodes -days 365000 -key ca-key.pem -out ca-cert.pem

$ pwd
/Users/liuxg/demos/filebeat_logstash
$ ls
ca-key.pem
$ openssl req -new -x509 -nodes -days 365000 -key ca-key.pem -out ca-cert.pem
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:Beijing
Locality Name (eg, city) []:Beijing
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Elastic
Organizational Unit Name (eg, section) []:Community
Common Name (e.g. server FQDN or YOUR name) []:Xiaoguo
Email Address []:x@y.com
$ ls
ca-cert.pem ca-key.pem

为 Logstash 和 Filebeat 创建证书和密钥

# Generate a private key and certificate for Logstash and Filebeat using the CA
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
    -keyout /path/to/your/server.key \
    -out /path/to/your/server.crt \
    -CA /path/to/your/ca-cert.pem \
    -CAkey /path/to/your/ca-key.pem

openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
    -keyout ./server.key \
    -out ./server.crt \
    -CA ./ca-cert.pem \
    -CAkey ./ca-key.pem

$ pwd
/Users/liuxg/demos/filebeat_logstash
$ ls
ca-cert.pem ca-key.pem
$ openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
>     -keyout ./server.key \
>     -out ./server.crt \
>     -CA ./ca-cert.pem \
>     -CAkey ./ca-key.pem
........+...+.....+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*...........+..+.+...+.........+..+.............+...+..+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*..........+..........+.....+...+.........+.+..+......+.......+...............+..+...+.......+...+...+.....+......+......+.......+..+....+..+..........+..+......+......+.+..+.+..............+...+.......+..+...+.......+...+........+...+......+....+..+.......+.....+...............+......+................+......+...+......+.....+.+..+...+..........+........+................+...............+......+..+.+..+.........+...+.......+......+...+.....+.+...............+...+........+...+.........+...+.........+....+.....+.+........+...+.........+..........+......+..+.............+.....+....+...+..+.............+......+......+.........+..+...+....+...+............+...+..+.+......+.....+.+..+...+..................+.....................+....+..............+.+..+..........+..+...+....+...+......+.................+...+....+........+...+.+...........+..........+.....+...............+....+......+..............+...+......+......+...+.......+...+.....+...+.............+..+.......+.....+.+..+....+...+......+.....+..........+..+.........+.........+.+........+.+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
.+.+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*.........+......+...+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*........+.........+.........+.....+.+.....+.+.........+..+....+........+...+.......+........+...+......+...+...+............+..........+...+..+..........+.....+.............+..+...+...+....+...+..............+....+..+......................+..+...+...+...+.+.........+......+...+..+.+...+.....+.........+...+...+.+...+..+.+........+............+..........+..+.+.....................+......+........+.+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:Beijing
Locality Name (eg, city) []:Beijing
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Elastic
Organizational Unit Name (eg, section) []:Community 
Common Name (e.g. server FQDN or YOUR name) []:localhost
Email Address []:x@y.com

按照同样的方法，我们生成相应的 client 证书：

openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
    -keyout client.key \
    -out client.crt \
    -CA ./ca-cert.pem \
    -CAkey ./ca-key.pem

$ openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
>     -keyout ./server.key \
>     -out ./server.crt \
>     -CA ./ca-cert.pem \
>     -CAkey ./ca-key.pem
........+...+.....+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*...........+..+.+...+.........+..+.............+...+..+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*..........+..........+.....+...+.........+.+..+......+.......+...............+..+...+.......+...+...+.....+......+......+.......+..+....+..+..........+..+......+......+.+..+.+..............+...+.......+..+...+.......+...+........+...+......+....+..+.......+.....+...............+......+................+......+...+......+.....+.+..+...+..........+........+................+...............+......+..+.+..+.........+...+.......+......+...+.....+.+...............+...+........+...+.........+...+.........+....+.....+.+........+...+.........+..........+......+..+.............+.....+....+...+..+.............+......+......+.........+..+...+....+...+............+...+..+.+......+.....+.+..+...+..................+.....................+....+..............+.+..+..........+..+...+....+...+......+.................+...+....+........+...+.+...........+..........+.....+...............+....+......+..............+...+......+......+...+.......+...+.....+...+.............+..+.......+.....+.+..+....+...+......+.....+..........+..+.........+.........+.+........+.+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
.+.+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*.........+......+...+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*........+.........+.........+.....+.+.....+.+.........+..+....+........+...+.......+........+...+......+...+...+............+..........+...+..+..........+.....+.............+..+...+...+....+...+..............+....+..+......................+..+...+...+...+.+.........+......+...+..+.+...+.....+.........+...+...+.+...+..+.+........+............+..........+..+.+.....................+......+........+.+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:Beijing
Locality Name (eg, city) []:Beijing
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Elastic
Organizational Unit Name (eg, section) []:Community 
Common Name (e.g. server FQDN or YOUR name) []:localhost
Email Address []:x@y.com
$ openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
>     -keyout client.key \
>     -out client.crt \
>     -CA ./ca-cert.pem \
>     -CAkey ./ca-key.pem
....+...+.+.....+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*.+.........+........+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*......+....+.....+....+...+...+..+..................+.+..............+.+.....................+...+..+.............+..+.......+..+......+............+......+.+......+.........+.........+......+...+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
..+.....+..................+.+..+............+.+..+....+......+...+.....+.......+...+.....+......+...+.............+........+.+.....+....+..+.......+......+..+....+...+..+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*....+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*.+.....+......+.+...+..+....+.....+.............+........+.......+...+............+.....+..................+.......+..+.+.........+...............+.....+.+..+...+...+.+......+.....+.......+.....+...+.........+......+....+...+...........+....+...........+......+.........+....+.....+......+......+.+.....+..........+.....+............+.+......+...+...+...+..+.......+..+...+......+.+......+.....+....+...+..+...............+....+...............+..+.........+...+.+.....+................+.....+.+...+......+.....+......+.......+..+...+......+.+......+...+.....+.........+......................+...+.....+...+...+......+.........+.+.....+....+.....+...............+....+...+.....+............+.+..+.......+..+...+...+............+..........+..+................+..+...+...+.+...+........+...+.+...........+.........+......+..................+....+.....+............+....+.....+......+....+..+....+.....+.+.....+...+...............+....+.....+..........+..+................+..+............+.........+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:Beijing
Locality Name (eg, city) []:Beijing
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Elastic
Organizational Unit Name (eg, section) []:Community
Common Name (e.g. server FQDN or YOUR name) []:localhost
Email Address []:x@y.com
$ ls
ca-cert.pem                           filebeat-8.12.0-darwin-aarch64.tar.gz
ca-key.pem                            logstash-8.12.0
client.crt                            logstash-8.12.0-darwin-aarch64.tar.gz
client.key                            server.crt
filebeat-8.12.0-darwin-aarch64        server.key

配置 Filebeat（或任何 Beat）

output.logstash:
  hosts: ["localhost:5044"]
  
  # Specify the path to the CA certificate for verification
  ssl.certificate_authorities: ["/path/to/your/ca-cert.pem"]
  
  # Specify the path to the client certificate
  ssl.certificate: "/path/to/your/server.crt"
  
  # Specify the path to the client private key
  ssl.key: "/path/to/your/server.key"

配置 Logstash

input {
  beats {
    port => 5044
    ssl => true
    
    # Specify the path to the CA certificate for verification
    ssl_certificate_authorities => ["/path/to/your/ca-cert.pem"]
    
    # Specify the path to the server certificate
    ssl_certificate => "/path/to/your/server.crt"
    
    # Specify the path to the server private key
    ssl_key => "/path/to/your/server.key"
    
    # Set peer verification mode to force_peer
    ssl_verify_mode => "force_peer"
  }
}

确保将 /path/to/your/ 替换为密钥和证书的实际所需路径。

测试

我们在当前的目录下安装 Filebeat 及 Logstash：

filebeat_ssl.yml

$ pwd
/Users/liuxg/demos/filebeat_logstash
$ ls 
ca-cert.pem                           logstash-8.12.0
ca-key.pem                            logstash-8.12.0-darwin-aarch64.tar.gz
filebeat-8.12.0-darwin-aarch64        server.crt
filebeat-8.12.0-darwin-aarch64.tar.gz server.key
$ cd filebeat-8.12.0-darwin-aarch64
$ ls filebeat_ssl.yml 
filebeat_ssl.yml

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - ./logfile.log
output.logstash:
  hosts: ["localhost:5044"]
  ssl.certificate_authorities: ["../ca-cert.pem"]
  ssl.certificate: "../server.crt"
  ssl.key: "../server.key"
logging:
  level: info
  to_files: true
  files:
  path: .
  name: filebeat.log
  keepfiles: 7
  permissions: 0644

我们在 filebeat 安装目录下创建一个叫做 logfile.log 的文件。它的内容如下：

logfile.log

This is a test log

logstash.conf

input {
  beats {
    port => 5044
    ssl => true
    ssl_certificate_authorities => "../ca-cert.pem"
    ssl_certificate => "../server.crt"
    ssl_key => "../server.key"
    ssl_verify_mode => "force_peer"
  }
}

output {
  stdout { codec => rubydebug }
  file {
    path => "../outputfile.log"
  }
}

我们首先运行 logstash：

./bin/logstash -f logstash.conf

我们再接下来运行 Filebeat：

我们回到 Logstash 运行的 terminal 中进行查看：

从上面的输出中，我们可以看到日志被正确地采集到 Logstash。我们可以更进一步输出到 Elasticsearch。在这里，我们就不再累述了。

相关推荐
互联网安全研究院3 分钟前
盘点 | 2024上半年国内数据安全事件
网络·安全
shark_西瓜甜12 分钟前
shark云原生-日志体系-ECK
elasticsearch·docker·云原生
Elastic 中国社区官方博客24 分钟前
Elasticsearch：Ingest architectures - 摄取架构
大数据·elasticsearch·搜索引擎·架构·全文检索
kinlon.liu1 小时前
基于 Nginx + Spring Boot + Vue + JPA 的网站安全防护指南
网络·vue.js·spring boot·nginx·安全
天下是个小趴菜2 小时前
蚁剑编码器编写——上篇
安全·web安全
网络研究院2 小时前
Rejetto HFS 服务器存在严重漏洞受到攻击
运维·服务器·安全·黑客·漏洞·警告·hfs
小小工匠2 小时前
加密与安全_ 解读非对称密钥解决密钥配送问题的四个方案
安全·非对称密钥
量化交易学徒2 小时前
403 Forbidden：深入解析 HTTP 禁止访问错误及排查方法
网络·网络协议·http
繁星日月3 小时前
利用docker搭建漏洞环境，使用SSRF+Redis写入centos以及ubuntu的公钥，实现免密登录
redis·安全·ubuntu·docker·容器·centos·渗透
炫酷的伊莉娜5 小时前
【网络安全】实验一（网络拓扑环境的搭建）
安全·web安全
热门推荐
012024年江苏省研究生数学建模科研创新实践大赛C题气象数据高精度融合技术研究论文和代码分析02Coze扣子平台完整体验和实践（附国内和国际版对比）03组基轨迹建模 GBTM的介绍与实现（Stata 或 R）042024亚太赛（中文赛）数学建模竞赛选题建议+初步分析05yolov8实战第五天——yolov8+ffmpg实时视频流检测并进行实时推流——（推流，保姆教学）06【经验分享】Ubuntu22.04安装微信(linux官方版)072024 年第十四届 APMCM 亚太地区大学生数学建模竞赛B题超详细解题思路+数据预处理问题一代码分享082025张宇考研数学，百度网盘视频课+36讲PDF讲义+真题09【立创EDA-PCB设计基础】6.布线铺铜实战及细节详解10通用大模型VS垂直大模型，你更青睐哪一方？