Elasticsearch7.7设置账号密码时的逻辑矛盾问题

Posted 2022-11-27 张志翔 ̮

        2019年1月30日，外媒又报道了一起Elasticsearch数据泄露事件！2019年1月份的至少有6起Elasticsearch数据泄露事件了。原因何在，很简单，开发者在服务启动之后总是懒得去修改，哪怕是添加个密码，不信？你去看看你们公司的REDIS服务器，看看有多少设置了密码，至少我公司不相关的部门的业务，他们的REDIS我都能远程登录(因对接关系我知道了redis服务器IP)。
好吧，回到Elasticsearch7.7的密码设置问题上来吧，说说我遇到的Elasticsearch设置账号密码时的矛盾问题，很扯蛋。不过也不要上纲上线，因为这问题肯定是可以解决的，但我在写这篇笔记的时候还没有找到方法，而我又想基于此留下点笔记。操作过程如下：

#1.开始给elasticsearch设置密码

tiger@n21-045-025:/usr/share/elasticsearch$ sudo bin/elasticsearch-setup-passwords interactive

It doesn't look like the X-Pack security feature is enabled on this Elasticsearch node.

Please check if you have enabled X-Pack security in your elasticsearch.yml configuration file.

ERROR: X-Pack Security is disabled by configuration.

#提示没有在配置文件中开启X-Pack，OK

#2.开启X-Pack配置

tiger@n21-045-025:/opt/elasticsearch$ sudo vim /etc/elasticsearch/elasticsearch.yml

http.cors.enabled: true

http.cors.allow-origin: "*"

#新增加了以下两行配置

xpack.security.enabled: true

xpack.security.transport.ssl.enabled: true

#3.增加完配置之后要重启elasticsearch不？你说不重启能行吗?不重启就还是没有配置啊。

#重启elasticsearch之后，然后我们再来配置密码

#修改完配置重启es之后使用elasticsearch-setup-passwords interactive

tiger@n21-045-025:/usr/share/elasticsearch$ sudo bin/elasticsearch-setup-passwords interactive

#Initiating the setup of passwords for reserved users elastic,apm_system,kibana,logstash_system,beats_system,remote_monitoring_user.

Enter password for [elastic]:

Reenter password for [elastic]:

Enter password for [apm_system]:

Reenter password for [apm_system]:

Enter password for [kibana]:

Reenter password for [kibana]:

Enter password for [logstash_system]:

Reenter password for [logstash_system]:

Enter password for [beats_system]:

Reenter password for [beats_system]:

Enter password for [remote_monitoring_user]:

Reenter password for [remote_monitoring_user]:

Unexpected response code [503] from calling PUT http://192.21.15.25:9200/_security/user/apm_system/_password?pretty

Cause: Cluster state has not been recovered yet, cannot write to the [null] index

Possible next steps:

* Try running this tool again.

* Try running with the --verbose parameter for additional messages.

* Check the elasticsearch logs for additional error details.

* Use the change password API manually.

ERROR: Failed to set password for user [apm_system]

#看设置报错：

tiger@n21-045-025:/usr/share/elasticsearch$ sudo bin/elasticsearch-setup-passwords interactive --verbose

Running with configuration path: /etc/elasticsearch

Testing if bootstrap password is valid for http://192.21.15.25:9200/_security/_authenticate?pretty

Checking cluster health: http://192.21.15.25:9200/_cluster/health?pretty



  "error" : 

    "root_cause" : [

      

        "type" : "master_not_discovered_exception",

        "reason" : null

      

    ],

    "type" : "master_not_discovered_exception",

    "reason" : null

  ,

  "status" : 503



Failed to determine the health of the cluster running at http://192.21.15.25:9200

Unexpected response code [503] from calling GET http://192.21.15.25:9200/_cluster/health?pretty

Cause: master_not_discovered_exception

It is recommended that you resolve the issues with your cluster before running elasticsearch-setup-passwords.

It is very likely that the password changes will fail when run against an unhealthy cluster.

Do you want to continue with the password setup process [y/N]ERROR: User cancelled operation

        看上面的报错，这时提示9200服务报503错误，什么原因呢？我设置了要要账号密码啊。现在从浏览器访问9200端口也是需要账号密码才能登录的，请求http://192.21.15.25:9200/_cluster/health?pretty接口也会阻塞一直不响应，因为在等待账号密码呢。
这就矛盾了：我没启用xpack.security.enabled时，不能进入设置密码。但我启动了之后设置密码时它会调用_cluster/health?pretty检查集群状态然后就有问题了。这不矛盾了吗？

        网上找了一些资料，包括google,但也都没有解决：比如 https://stackoverflow.com/questions/61884976/apply-security-on-elk-cluster-authentication-issue 这里说把所有的节点都加上上面的X-pack配置重启，然后使用auto进行密码设置。一样会出现无法检查集群健康状态的问题。Failed to determine the health of the cluster running at http://192.21.15.25:9200 Unexpected response code [503] from calling GET http://192.21.15.25:9200/_cluster/health?pretty

        这个肯定不能是个问题！这个也一定能解决的，暂时挺脑火，留个笔记在这里！