1 新增配置
每个集群节点都需要设置,编辑 elasticsearch.yml 文件:
cd /home/isearch/es
vi es-cluster-01/config/elasticsearch.yml
vi es-cluster-02/config/elasticsearch.yml
vi es-cluster-03/config/elasticsearch.yml
# 设置启用了X-Pack安全特性,包括身份验证、授权、加密通信和审计等功能
xpack.security.enabled: true
# 设置指定了使用基本类型的自生成许可证
xpack.license.self_generated.type: basic
# 设置启用了节点间通信的SSL/TLS加密
xpack.security.transport.ssl.enabled: true
# 设置定义了SSL/TLS通信时的证书验证模式
xpack.security.transport.ssl.verification_mode: certificate
# 设置指定了包含SSL密钥和证书的PKCS#12文件(.p12)的路径
xpack.security.transport.ssl.keystore.path: elastic-certificates.p12
# 设置指定了包含受信任证书集合的PKCS#12文件的路径
xpack.security.transport.ssl.truststore.path: elastic-certificates.p12
2 生成CA证书
在es的bin下执行
cd /home/isearch/es/es-cluster-01/bin
./elasticsearch-certutil ca
Please enter the desired output file [elastic-stack-ca.p12]: // 设置文件生成名称(可回车跳过,默认为elastic-stack-ca.p12)
Enter password for elastic-stack-ca.p12 : // 设置证书密码(如不设置也可回车跳过)
对生成的CA证书进行验证
依次执行以下命令
./elasticsearch-certutil cert --ca elastic-stack-ca.p12 # 依次输入上一个步骤的密码。回车(文件使用默认名),密码(建议与上一步密码相同)
./elasticsearch-keystore add xpack.security.transport.ssl.keystore.secure_password #并输入第一步输入的密码
./elasticsearch-keystore add xpack.security.transport.ssl.truststore.secure_password #并输入第一步输入的密码
执行完命令后会得到三个文件,如不设置文件名称,则是elastic-certificates.p12、elasticsearch.keystore、elastic-stack-ca.p12
其中(我的设置完路径如下)elastic-certificates.p12、elastic-stack-ca.p12在es根路径,elasticsearch.keystore在config目录下
将这三个文件都拷贝到config目录下,然后在之前的xpack配置后增加:
cd /home/isearch/es/es-cluster-01
mv elastic-certificates.p12 ./config/
mv elastic-stack-ca.p12 ./config/
将节点 1 上的证书依次拷贝到其他节点:
cd ./config
cp elastic-certificates.p12 ~/es/es-cluster-02/config/
cp elasticsearch.keystore ~/es/es-cluster-02/config/
cp elastic-stack-ca.p12 ~/es/es-cluster-02/config/
cp elastic-certificates.p12 ~/es/es-cluster-03/config/
cp elasticsearch.keystore ~/es/es-cluster-03/config/
cp elastic-stack-ca.p12 ~/es/es-cluster-03/config/
配置修改完成,重启es服务
3 重启 ES 集群
ps -ef | grep elasticsearch
停止es进程
ES 集群不启动,下面的添加密码操作执行不了,所以依次启动 3 个节点。
~/es/es-cluster-01/bin/elasticsearch -d
~/es/es-cluster-02/bin/elasticsearch -d
~/es/es-cluster-03/bin/elasticsearch -d
4 验证es启动成功
es启动比较慢,需要等待一段时间
curl http://192.168.12.33:9201
curl http://192.168.12.33:9202
curl http://192.168.12.33:9203
es启动成功
5 在任意一台es机器执行设置用户名和密码的命令
cd /home/isearch/es/es-cluster-01/bin
./elasticsearch-setup-passwords interactive
修改密码
curl -u elastic:111111 -H "Content-Type:application/json; charset=UTF-8" -XPUT http://192.168.12.33:9200/_security/user/apm_system/_password -d '{"password":"elastic_pwd"}'
curl -u elastic:111111 -H "Content-Type:application/json; charset=UTF-8" -XPUT http://192.168.12.33:9200/_security/user/kibana/_password -d '{"password":"elastic_pwd"}'
curl -u elastic:111111 -H "Content-Type:application/json; charset=UTF-8" -XPUT http://192.168.12.33:9200/_security/user/logstash_system/_password -d '{"password":"elastic_pwd"}'
curl -u elastic:111111 -H "Content-Type:application/json; charset=UTF-8" -XPUT http://192.168.12.33:9200/_security/user/beats_system/_password -d '{"password":"elastic_pwd"}'
curl -u elastic:111111 -H "Content-Type:application/json; charset=UTF-8" -XPUT http://192.168.12.33:9200/_security/user/remote_monitoring_user/_password -d '{"password":"elastic_pwd"}'
curl -u elastic:111111 -H "Content-Type:application/json; charset=UTF-8" -XPUT http://192.168.12.33:9200/_security/user/elastic/_password -d '{"password":"elastic_pwd"}'