对Elastic集群配置TLS加密通信及身份验证

Posted 2022-09-06 sanduzxcvbnm

1、介绍

官方宣布从6.8和7.1开始，免费提供多项安全功能。其中包括tls加密通信，基于角色访问控制等功能。
可以使用企业CA证书来完成这一步骤，但是一般情况下，我们可以通过elasticsearch自带的elasticsearch-certutil的命令生成证书。然后各节点通过该证书可以进行安全通信。

2. 步骤

2.1 生成证书

搭建好了es集群，先拿第一个节点来操作，进入elasticsearch目录，然后执行以下命令。

cd /usr/share/elasticsearch  # 使用yum方式安装的可执行文件路径
bin/elasticsearch-certutil cert -out /etc/elasticsearch/elastic-certificates.p12 -pass "" # 生成证书到配置文件目录

# 成功提示
Certificates written to /etc/elasticsearch/elastic-certificates.p12

This file should be properly secured as it contains the private key for 
your instance.

This file is a self contained file and can be copied and used 'as is'
For each Elastic product that you wish to configure, you should copy
this '.p12' file to the relevant configuration directory
and then follow the SSL configuration instructions in the product guide.

上面命令执行成功后，会在/etc/elasticsearch/文件夹下生成elastic-certificates.p12证书

注意：在本机生成的证书需要更改证书权限：chmod 644 elastic-certificates.p12
默认证书权限是600，运行elasticsearch程序的用户没有权限读取，会造成elasticsearch启动失败

2.2 编辑配置文件，开启证书访问

编辑配置文件/etc/elasticsearch/elasticsearch.yml，取消掉下面几行的注释(注意证书路径)

xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: elastic-certificates.p12

将上面步骤生成的elastic-certificates.p12证书复制到另外两个es节点上对应的/etc/elasticsearch/文件夹中，同时将上面
xpack.security.*配置选项也都复制到对应节点的elasticsearch.yml文件里

2.3 设置密码

启动三个节点，待节点启动完毕之后，进入第一个节点elasticsearch目录，执行以下命令，进行密码设置：

cd /usr/share/elasticsearch
bin/elasticsearch-setup-passwords interactive

# 输出结果
Initiating the setup of passwords for reserved users elastic,apm_system,kibana,logstash_system,beats_system,remote_monitoring_user.
You will be prompted to enter passwords as the process progresses.
Please confirm that you would like to continue [y/N]y # 输入y

# 直接输入密码，然后再重复一遍密码，中括号里是账号
Enter password for [elastic]: 
Reenter password for [elastic]: 
Enter password for [apm_system]: 
Reenter password for [apm_system]: 
Enter password for [kibana]: 
Reenter password for [kibana]: 
Enter password for [logstash_system]: 
Reenter password for [logstash_system]: 
Enter password for [beats_system]: 
Reenter password for [beats_system]: 
Enter password for [remote_monitoring_user]: 
Reenter password for [remote_monitoring_user]: 
Changed password for user [apm_system]
Changed password for user [kibana]
Changed password for user [logstash_system]
Changed password for user [beats_system]
Changed password for user [remote_monitoring_user]
Changed password for user [elastic]

为了方便后续使用，这里可以都设置成一样
password: elkstack123456

验证集群设置的账号和密码
打开浏览器访问这个地址，出现需要输入账号密码的界面证明设置成功,集群的一个节点
http://192.168.80.105:9200/_security/_authenticate?pretty

2.4 logstash增加访问es集群的用户及密码

logstash过滤数据之后往es中推送的时候，需要添加权限认证。增加访问es集群的用户及密码：

output 

  if [fields][log_source] == 'messages' 
    elasticsearch 
      hosts => ["http://192.168.80.104:9200", "http://192.168.80.105:9200","http://192.168.80.106:9200"]
      index => "messages-%+YYYY.MM.dd"
      user => "elastic" # 账号是默认的
      password => "elkstack123456" # 密码是上面步骤设置的
    
  

  if [fields][log_source] == "secure" 
    elasticsearch 
      hosts => ["http://192.168.80.104:9200", "http://192.168.80.105:9200","http://192.168.80.106:9200"]
      index => "secure-%+YYYY.MM.dd"
      user => "elastic"
      password => "elkstack123456"
    
  

2.5 elasticsearch-head访问es集群的用户及密码

elasticsearch-head插件此时再去访问有安全认证的es集群时，会发现无法进行查看，打开控制台可以看到报错:401 unauthorized
解决办法是修改elasticsearch.yml文件，增加以下配置。

http.cors.allow-headers: Authorization,content-type

修改三台es节点，然后重新启动，再次url+认证信息方式可以正常访问es集群。

http://192.168.80.104:9100/?auth_user=elkstack&auth_password=elkstack123456

2.6 Kibana组件访问带有安全认证的Elasticsearch集群

配置文件kibana.yml中需要加入以下配置

elasticsearch.username: "elkstack"
elasticsearch.password: "elkstack123456"

然后重启kibana，再次访问的话就就需要输入上述账号密码才能登陆访问了

不一样的地方：
在Management下面的Kibana最后出现一个Security，有User和Role
方便kibana多用户创建及角色权限控制