elasticsearch配置xpack集群间加密认证时报错：

已于 2022-04-29 07:08:08 修改
阅读量3.2k 收藏
点赞数
文章标签： elasticsearch
于 2022-04-11 08:16:52 首次发布
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/epitomizelu/article/details/124090351
版权

通过证书配置集群间节点通信认证：

bin/elasticsearch -E node.name=node1 -E cluster.name=geektime -E path.data=node1_data -E http.port=9200 -E xpack.security.enabled=true -E xpack.security.transport.ssl.enabled=true -E xpack.security.transport.ssl.verification_mode=certificate -E xpack.security.transport.ssl.keystore.path=certs/elastic-certificates.p12 -E xpack.security.transport.ssl.truststore.path=/user/share/elasticsearch/certs/elastic-certificates.p12

报错信息：

java.security.AccessControlException: access denied ("java.io.FilePermission" "/usr/share/elasticsearch/certs" "read")
	at java.base/java.security.AccessControlContext.checkPermission(AccessControlContext.java:472)
	at java.base/java.security.AccessController.checkPermission(AccessController.java:1036)
	at java.base/java.lang.SecurityManager.checkPermission(SecurityManager.java:408)
	at java.base/java.lang.SecurityManager.checkRead(SecurityManager.java:747)
	at java.base/sun.nio.fs.UnixPath.checkRead(UnixPath.java:810)
	at java.base/sun.nio.fs.UnixFileSystemProvider.exists(UnixFileSystemProvider.java:532)
	at java.base/java.nio.file.Files.exists(Files.java:2514)
	at org.elasticsearch.watcher.FileWatcher$FileObserver.init(FileWatcher.java:147)
	at org.elasticsearch.watcher.FileWatcher$FileObserver.access$000(FileWatcher.java:65)
	at org.elasticsearch.watcher.FileWatcher.doInit(FileWatcher.java:55)
	at org.elasticsearch.watcher.AbstractResourceWatcher.init(AbstractResourceWatcher.java:25)
	at org.elasticsearch.watcher.ResourceWatcherService.add(ResourceWatcherService.java:118)
	at org.elasticsearch.xpack.core.ssl.SSLConfigurationReloader.startWatching(SSLConfigurationReloader.java:103)
	at org.elasticsearch.xpack.core.ssl.SSLConfigurationReloader.<init>(SSLConfigurationReloader.java:47)
	at org.elasticsearch.xpack.core.XPackPlugin.createSSLService(XPackPlugin.java:453)
	at org.elasticsearch.xpack.core.XPackPlugin.createComponents(XPackPlugin.java:298)
	at org.elasticsearch.node.Node.lambda$new$18(Node.java:605)
	at java.base/java.util.stream.ReferencePipeline$7$1.accept(ReferencePipeline.java:273)
	at java.base/java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1625)
	at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:484)
	at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:474)
	at java.base/java.util.stream.ReduceOps$ReduceOp.evaluateSequential(ReduceOps.java:913)
	at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)
	at java.base/java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:682)
	at org.elasticsearch.node.Node.<init>(Node.java:609)
	at org.elasticsearch.node.Node.<init>(Node.java:278)
	at org.elasticsearch.bootstrap.Bootstrap$5.<init>(Bootstrap.java:217)
	at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:217)
	at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:397)
	at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:159)

各种尝试：授权文件777、把文件放在config/certs下、放在/opt/elaticsearch/certs下，都想不通，然后猜测可能是路径问题，于是不写绝对路径，指定相对路径，看看es从那个目录下获取，改了之后包如下错误，发现是从/etc/elasticsearch/certs下读取：

Caused by: org.elasticsearch.ElasticsearchException: failed to initialize SSL TrustManager - truststore file [/etc/elasticsearch/certs/elastic-certificates.p12] does not exist
	at org.elasticsearch.xpack.core.ssl.TrustConfig.missingTrustConfigFile(TrustConfig.java:114) ~[?:?]
	at org.elasticsearch.xpack.core.ssl.StoreTrustConfig.createTrustManager(StoreTrustConfig.java:69) ~[?:?]
	at org.elasticsearch.xpack.core.ssl.SSLService.createSslContext(SSLService.java:439) ~[?:?]
	at java.util.HashMap.computeIfAbsent(HashMap.java:1224) ~[?:?]
	at org.elasticsearch.xpack.core.ssl.SSLService.lambda$loadSSLConfigurations$5(SSLService.java:528) ~[?:?]
	at java.util.HashMap.forEach(HashMap.java:1425) ~[?:?]
	at java.util.Collections$UnmodifiableMap.forEach(Collections.java:1521) ~[?:?]
	at org.elasticsearch.xpack.core.ssl.SSLService.loadSSLConfigurations(SSLService.java:526) ~[?:?]
	at org.elasticsearch.xpack.core.ssl.SSLService.<init>(SSLService.java:144) ~[?:?]
	at org.elasticsearch.xpack.core.XPackPlugin.createSSLService(XPackPlugin.java:454) ~[?:?]
	at org.elasticsearch.xpack.core.XPackPlugin.createComponents(XPackPlugin.java:298) ~[?:?]
	at org.elasticsearch.node.Node.lambda$new$18(Node.java:605) ~[elasticsearch-7.13.0.jar:7.13.0]
	at java.util.stream.ReferencePipeline$7$1.accept(ReferencePipeline.java:273) ~[?:?]
	at java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1625) ~[?:?]
	at java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:484) ~[?:?]
	at java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:474) ~[?:?]
	at java.util.stream.ReduceOps$ReduceOp.evaluateSequential(ReduceOps.java:913) ~[?:?]
	at java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234) ~[?:?]
	at java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:682) ~[?:?]
	at org.elasticsearch.node.Node.<init>(Node.java:609) ~[elasticsearch-7.13.0.jar:7.13.0]
	at org.elasticsearch.node.Node.<init>(Node.java:278) ~[elasticsearch-7.13.0.jar:7.13.0]
	at org.elasticsearch.bootstrap.Bootstrap$5.<init>(Bootstrap.java:217) ~[elasticsearch-7.13.0.jar:7.13.0]
	at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:217) ~[elasticsearch-7.13.0.jar:7.13.0]
	at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:397) ~[elasticsearch-7.13.0.jar:7.13.0]
	at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:159) ~[elasticsearch-7.13.0.jar:7.13.0]
	... 6 more
Caused by: java.nio.file.NoSuchFileException: /etc/elasticsearch/certs/elastic-certificates.p12
	at sun.nio.fs.UnixException.translateToIOException(UnixException.java:92) ~[?:?]
	at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:106) ~[?:?]
	at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:111) ~[?:?]
	at sun.nio.fs.UnixFileSystemProvider.newByteChannel(UnixFileSystemProvider.java:219) ~[?:?]
	at java.nio.file.Files.newByteChannel(Files.java:375) ~[?:?]
	at java.nio.file.Files.newByteChannel(Files.java:426) ~[?:?]
	at java.nio.file.spi.FileSystemProvider.newInputStream(FileSystemProvider.java:420) ~[?:?]
	at java.nio.file.Files.newInputStream(Files.java:160) ~[?:?]
	at org.elasticsearch.xpack.core.ssl.TrustConfig.getStore(TrustConfig.java:96) ~[?:?]
	at org.elasticsearch.xpack.core.ssl.StoreTrustConfig.createTrustManager(StoreTrustConfig.java:66) ~[?:?]
	at org.elasticsearch.xpack.core.ssl.SSLService.createSslContext(SSLService.java:439) ~[?:?]
	at java.util.HashMap.computeIfAbsent(HashMap.java:1224) ~[?:?]
	at org.elasticsearch.xpack.core.ssl.SSLService.lambda$loadSSLConfigurations$5(SSLService.java:528) ~[?:?]
	at java.util.HashMap.forEach(HashMap.java:1425) ~[?:?]
	at java.util.Collections$UnmodifiableMap.forEach(Collections.java:1521) ~[?:?]
	at org.elasticsearch.xpack.core.ssl.SSLService.loadSSLConfigurations(SSLService.java:526) ~[?:?]
	at org.elasticsearch.xpack.core.ssl.SSLService.<init>(SSLService.java:144) ~[?:?]
	at org.elasticsearch.xpack.core.XPackPlugin.createSSLService(XPackPlugin.java:454) ~[?:?]
	at org.elasticsearch.xpack.core.XPackPlugin.createComponents(XPackPlugin.java:298) ~[?:?]
	at org.elasticsearch.node.Node.lambda$new$18(Node.java:605) ~[elasticsearch-7.13.0.jar:7.13.0]
	at java.util.stream.ReferencePipeline$7$1.accept(ReferencePipeline.java:273) ~[?:?]
	at java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1625) ~[?:?]
	at java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:484) ~[?:?]
	at java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:474) ~[?:?]
	at java.util.stream.ReduceOps$ReduceOp.evaluateSequential(ReduceOps.java:913) ~[?:?]
	at java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234) ~[?:?]
	at java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:682) ~[?:?]
	at org.elasticsearch.node.Node.<init>(Node.java:609) ~[elasticsearch-7.13.0.jar:7.13.0]
	at org.elasticsearch.node.Node.<init>(Node.java:278) ~[elasticsearch-7.13.0.jar:7.13.0]
	at org.elasticsearch.bootstrap.Bootstrap$5.<init>(Bootstrap.java:217) ~[elasticsearch-7.13.0.jar:7.13.0]
	at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:217) ~[elasticsearch-7.13.0.jar:7.13.0]
	at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:397) ~[elasticsearch-7.13.0.jar:7.13.0]
	at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:159) ~[elasticsearch-7.13.0.jar:7.13.0]
	... 6 more
uncaught exception in thread [main]
ElasticsearchSecurityException[failed to load SSL configuration [xpack.security.transport.ssl]]; nested: ElasticsearchException[failed to initialize SSL TrustManager - truststore file [/etc/elasticsearch/certs/elastic-certificates.p12] does not exist]; nested: NoSuchFileException[/etc/elasticsearch/certs/elastic-certificates.p12];
Likely root cause: java.nio.file.NoSuchFileException: /etc/elasticsearch/certs/elastic-certificates.p12
	at java.base/sun.nio.fs.UnixException.translateToIOException(UnixException.java:92)
	at java.base/sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:106)
	at java.base/sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:111)
	at java.base/sun.nio.fs.UnixFileSystemProvider.newByteChannel(UnixFileSystemProvider.java:219)
	at java.base/java.nio.file.Files.newByteChannel(Files.java:375)
	at java.base/java.nio.file.Files.newByteChannel(Files.java:426)
	at java.base/java.nio.file.spi.FileSystemProvider.newInputStream(FileSystemProvider.java:420)
	at java.base/java.nio.file.Files.newInputStream(Files.java:160)
	at org.elasticsearch.xpack.core.ssl.TrustConfig.getStore(TrustConfig.java:96)
	at org.elasticsearch.xpack.core.ssl.StoreTrustConfig.createTrustManager(StoreTrustConfig.java:66)
	at org.elasticsearch.xpack.core.ssl.SSLService.createSslContext(SSLService.java:439)
	at java.base/java.util.HashMap.computeIfAbsent(HashMap.java:1224)
	at org.elasticsearch.xpack.core.ssl.SSLService.lambda$loadSSLConfigurations$5(SSLService.java:528)
	at java.base/java.util.HashMap.forEach(HashMap.java:1425)
	at java.base/java.util.Collections$UnmodifiableMap.forEach(Collections.java:1521)
	at org.elasticsearch.xpack.core.ssl.SSLService.loadSSLConfigurations(SSLService.java:526)
	at org.elasticsearch.xpack.core.ssl.SSLService.<init>(SSLService.java:144)
	at org.elasticsearch.xpack.core.XPackPlugin.createSSLService(XPackPlugin.java:454)
	at org.elasticsearch.xpack.core.XPackPlugin.createComponents(XPackPlugin.java:298)
	at org.elasticsearch.node.Node.lambda$new$18(Node.java:605)
	at java.base/java.util.stream.ReferencePipeline$7$1.accept(ReferencePipeline.java:273)
	at java.base/java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1625)
	at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:484)
	at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:474)
	at java.base/java.util.stream.ReduceOps$ReduceOp.evaluateSequential(ReduceOps.java:913)
	at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)
	at java.base/java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:682)
	at org.elasticsearch.node.Node.<init>(Node.java:609)
	at org.elasticsearch.node.Node.<init>(Node.java:278)
	at org.elasticsearch.bootstrap.Bootstrap$5.<init>(Bootstrap.java:217)
	<<<truncated>>>

把证书复制到/etc/elasticsearch/certs下，重新启动，成功。

大数据男
关注
  • 0
    点赞
  • 踩
  • 0
    收藏
    觉得还不错? 一键收藏
  • 打赏
    打赏
  • 0
    评论
elasticsearch常见问题：xpack.security.transport.ssl、unknown setting [node.master]
iOS逆向与安全
03-14 318
进入解压后的elasticsearch-7.2.0 文件夹中的config文件夹，并修改elasticsearch.yml 文件中的配置。在后台启动elastic search进程，需要在启动时加个。在ES8中设置主节点的语句已经进行了修改，需要设置节点的角色。保存并退出后执行命令。
es xpack 配置详情
12-15
es xpack 配置详情 7.10.1，通过安装 es kibana，使用自带的 x pack 插件来完成权限控制，网上很多都不全，本文非常详细。es kibana 版本号为 7.10.1 与 7.10.0，并且附带相关的步骤，以及方案。
CentOS 7 部署 Elasticsearch7.4 集群并进行安全认证.docx
08-10
CentOS 7 部署 Elasticsearch7.4 集群并进行安全认证.docx
elasticsearch集群安全加密插件之search-guard
11-04
elasticsearch集群安全加密插件之search-guard
Elasticsearch_xpack
03-23
x-pack为elasticsearch, logstash, kibana提供了监控，报警，用户认证等功能，属于一个集成的插件。如果不使用X-PACK，自己来监控的话通常是使用zabbix+ API监控和报警。 但是ES默认不需要用户和密码登入，如果ES环境比较大，权限控制还是比较重要，也算是穿了件衣服，不那么容易曝光。
Elasticsearch集群安装配置.docx
02-05
Elasticsearch集群安装配置
Elasticsearch 设置X-pack时，报错ERROR: Failed to set password for user [apm_system].解决方法
CN_Eden
07-13 6245
环境信息： 系统 centos7.9 elasticsearch 7.1.1 集群信息： 服务 ip地址 es1 192.168.1.200 es2 192.168.1.201 es3 192.168.1.202 问题经过： 配置文件elasticsearch.yml新增x-pack功能 xpack.license.self_generated.type: basic xpack.security.enabled: true xpack.security.tr
安装x-pack后，无法设置密码和登录
weixin_39355187的博客
02-17 164
TBDS-Elasticsearch安全认证配置方法 - 云+社区 - 腾讯云
elasticsearch 7.x配置集群密码认证模式
Small_Green_Hand的博客
01-06 5937
一 生成证书 在elasticsearch目录下执行，会在目录elasticsearch的文件目录生成elastic-stack-ca.p12文件，比如我这里是/home/elasticsearch ./elasticsearch-certutil ca Please enter the desired output file [elastic-stack-ca.p12]: elastic-...
ElasticsearchSecurityException[failed to load SSL configuration [xpack.security.transport.ssl]]
u011012217的博客
05-26 8451
ElasticsearchSecurityException[failed to load SSL configuration [xpack.security.transport.ssl]]ES7报错的解决办法
ElasticsearchSecurityException[failed to load SSL configuration [xpack.security.transport.ssl]]； nes
热门推荐
weixin_44221035的博客
12-24 1万+
es配置X-Pack后报错 ElasticsearchSecurityException[failed to load SSL configuration [xpack.security.transport.ssl]]; nested: ElasticsearchException[failed to initialize SSL TrustManager - not permitted to read truststore file [/usr/local/elasticsearch-7.10.1/con
ElasticSearch集群配置文件
06-21
ElasticSearch集群配置文件 其他节点只需要修改以下内容： 1. node.name: es-node1 --节点名称不能一样 2. http.port: 8081 --节点端口 3. transport.port: 8090 --节点间通信端口 4. discovery.seed_hosts: --集群...
Kubernetes持久化部署elasticsearch7.15.0分布式集群
02-21
原文链接：https://blog.csdn.net/m0_37814112/article/details/122965720 说明：包含elasticsearch7.15.0集群3节点、5节点、7节点等三种方式的K8S部署yaml文件、镜像文件，里面有详细的README.txt部署参考
Elasticsearch 6.5.1 xpack 试用版安装教程20200701.pdf
07-01
环境：linux系统 ubuntu；JDK8； Elasticsearch 6.5.1 xpack 试用版
Elasticsearch7.3.1集群配置文件
01-20
#集群名称 cluster.name: lihang212010 当前节点名称 node.name: node-3 #data文件和日志保存地方，需要当前用户有操作权限 path.data: /path/to/data path.logs: /path/to/logs #network.host: 0.0.0.0 #当前服务器...
ElasticSearch面试题
最新发布
weixin_53676834的博客
04-29 1018
ElasticSearch是一个强大的分布式搜索引擎。它有个核心技术叫做倒排索引，可以帮助我们从海量数据中快速的找到所需要的内容，实现海量数据的搜素、分析和运算，响应时间通常很短。（聚合）ElasticSearch支持跨语言，它对外暴露的是Restful接口，不同的编程语言都可以通过HTTP请求与ElasticSearch进行交互。
linux常用非基础命令/操作
这个博主不懒，但Ta什么也没写~（私信互关24小时必回）
04-23 450
本篇用于总结蒟蒻博主在使用linux系统的过程中会经常用到但老实记不住的一些非基础命令和操作，方便遗忘时查阅。
ElasticSearch复合查寻
weixin_53676834的博客
04-25 604
如果子查询比较多，每一个都参与算分，是不是查询性能就会受到影响，而如果你在使用的时候，你用的是filter查询和must not查询，它们是不参与算分的。虽然BooleanQuery复合查询里面有这么四种组合关系，但是除了跟算分相关的，一般就是关键字：用户输入的个关键字，除了用户输入的个关键字以外，剩下的过滤条件都应该放在must_not 或者filter里边，尽可能的减少算分，提高查询的效率。·filter，从字面来看，它也是必须匹配，Must也是必须匹配，确实它俩都是必须匹配，都是”与”的意思。
Elasticsearch文本分析深度解析
一起coding，一起嗨。
04-28 368
Elasticsearch文本分析深度解析
【Elasticsearch】ES中时间查询报错：Caused by: ElasticsearchParseException[failed to parse date field [Sun Dec ...
05-27
这个错误通常是因为时间格式不正确导致的。在ES中，时间格式默认为ISO8601格式，例如：2022-01-01T01:00:00Z。如果你的时间格式不是ISO8601格式，你需要在查询中指定对应的格式，例如：yyyy-MM-dd HH:mm:ss。 你可以尝试修改查询语句中的时间格式，或者将时间格式转换为ISO8601格式再进行查询。如果还有问题，请提供更多的信息，以便我能够更好地帮助你。

“相关推荐”对你有帮助么？

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包

打赏作者

大数据男

你的鼓励将是我创作的最大动力

¥1 ¥2 ¥4 ¥6 ¥10 ¥20
扫码支付：¥1
获取中
扫码支付

您的余额不足，请更换扫码支付或充值

打赏作者

实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值