elasticsearch 安全配置集合

#配置hosts 文件
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
10.160.1.9 node01
10.160.1.10 node02
10.160.1.11 node03

设置环境变量（请根据 Elasticsearch 的下载方式和存储位置调整这些变量路径
 ES_HOME=/usr/share/elasticsearch
 ES_PATH_CONF=/etc/elasticsearch
# 使用bin/elasticsearch-certutil 生成证书
vim instance.yml
instances:
  - name: 'node01'
    dns: [ 'node01','localhost' ]
    ip: ['10.160.1.9','127.0.0.1']
  - name: "node02"
    dns: [ 'node02','localhost' ]
    ip: ['10.160.1.10','127.0.0.1']
  - name: 'node03'
    dns: [ 'node03','localhost' ]
    ip: ['10.160.1.11','127.0.0.1']
	
生成ca 默认在/usr/share/elasticsearch/ 下
/usr/share/elasticsearch/bin/elasticsearch-certutil ca --pem --days 10000 --out ~/ca.zip
unzip ca.zip
 /usr/share/elasticsearch/bin/elasticsearch-certutil cert --ca-cert ~/ca/ca.crt --ca-key ~/ca/ca.key  -days 10000  -pem -in ~/instance.yml -out ~/certs.zip

把 ca 和 node01 证书 拷贝到 /etc/elasticsearch/certs 下
es 做如下配置
[root@node01 certs]# egrep -v '^$|^#' /etc/elasticsearch/elasticsearch.yml
node.name: node01
path.data: /data/elasticsearch
path.logs: /data/elasticsearch
discovery.seed_hosts: ["node01"]
cluster.initial_master_nodes: ["node01"]
xpack.security.enabled: true
xpack.security.enrollment.enabled: true
xpack.security.http.ssl.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.http.ssl.key: certs/node01.key
xpack.security.http.ssl.certificate: certs/node01.crt
xpack.security.http.ssl.certificate_authorities: certs/ca.crt
xpack.security.transport.ssl.key: certs/node01.key
xpack.security.transport.ssl.certificate: certs/node01.crt
xpack.security.transport.ssl.certificate_authorities: certs/ca.crt
http.host: 0.0.0.0

启动查看node01 情况
 curl  https://node01:9200/  --cacert /etc/elasticsearch/certs/ca.crt
{"error":{"root_cause":[{"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{"WWW-Authenticate":["Basic realm=\"security\" charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}}],"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{"WWW-Authenticate":["Basic realm=\"security\" charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}},"status":401}


配置用户密码
cd $ES_HOME
bin/elasticsearch-setup-passwords auto -u "https://node01:9200"
# 出现错误
![image](https://img2022.cnblogs.com/blog/1260716/202206/1260716-20220604110256893-365564365.png)
#意思是这个命令读取/etc/elasticsearch/elasticsearch.keystore 中用户密码 这个密码现在不正确。
重置elastic用户密码使用命令修改 keystore 文件中密码值
 bin/elasticsearch-keystore  remove keystore.seed
  bin/elasticsearch-keystore  add keystore.seed
  
  /usr/share/elasticsearch/bin/elasticsearch-setup-passwords  auto
Changed password for user apm_system
PASSWORD apm_system = OC9Nx4jNeaA6Pq24bMUZ
Changed password for user kibana_system
PASSWORD kibana_system = f5y7cQcszhlGBMkLhcPq
Changed password for user kibana
PASSWORD kibana = f5y7cQcszhlGBMkLhcPq
Changed password for user logstash_system
PASSWORD logstash_system = xf4xUzHiKMnw0FHao8XT
Changed password for user beats_system
PASSWORD beats_system = pWh2VVCKOZcHf16JlgF5
Changed password for user remote_monitoring_user
PASSWORD remote_monitoring_user = BHKdJqzgWzvb5sj4DgIn
Changed password for user elastic
PASSWORD elastic = tFf1LuJt7oHKevQdmAtO

# 安装kibana 配置并启动
elasticsearch.hosts: ["https://node01:9200"]

# If your Elasticsearch is protected with basic authentication, these settings provide
# the username and password that the Kibana server uses to perform maintenance on the Kibana
# index at startup. Your Kibana users still need to authenticate with Elasticsearch, which
# is proxied through the Kibana server.
elasticsearch.username: "kibana"
elasticsearch.password: "f5y7cQcszhlGBMkLhcPq"


使用elastic 超级用户登录并访问

添加另外两台node 
只需要拷贝ca 和 对应的node 证书到相应节点即可

看一下最终形态
curl  -XGET  -k 'https://elastic:tFf1LuJt7oHKevQdmAtO@10.160.1.9:9200/_cat/nodes'
10.160.1.11 10 96 11 0.82 0.70 0.35 cdfhilmrstw - node03
10.160.1.10 24 96  6 0.14 0.17 0.16 cdfhilmrstw - node02
10.160.1.9  48 93  7 0.13 0.12 0.15 cdfhilmrstw * node01