elastic7.16 install 0 - Set up basic security for the Elastic Stack

Generate the certificate authority

Generate the certificate authorityedit
You can add as many nodes as you want in a cluster but they must be able to communicate with each other. The communication between nodes in a cluster is handled by the transport module. To secure your cluster, you must ensure that internode communications are encrypted and verified, which is achieved with mutual TLS.

In a secured cluster, Elasticsearch nodes use certificates to identify themselves when communicating with other nodes.

The cluster must validate the authenticity of these certificates. The recommended approach is to trust a specific certificate authority (CA). When nodes are added to your cluster they must use a certificate signed by the same CA.

For the transport layer, we recommend using a separate, dedicated CA instead of an existing, possibly shared CA so that node membership is tightly controlled. Use the elasticsearch-certutil tool to generate a CA for your cluster.

On any single node, use the elasticsearch-certutil tool to generate a CA for your cluster.

./bin/elasticsearch-certutil ca

When prompted, accept the default file name, which is elastic-stack-ca.p12. This file contains the public certificate for your CA and the private key used to sign certificates for each node.
Enter a password for your CA. You can choose to leave the password blank if you’re not deploying to a production environment.
On any single node, generate a certificate and private key for the nodes in your cluster. You include the elastic-stack-ca.p12 output file that you generated in the previous step.

./bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12
--ca <ca_file>

Name of the CA file used to sign your certificates. The default file name from the elasticsearch-certutil tool is elastic-stack-ca.p12.

Enter the password for your CA, or press Enter if you did not configure one in the previous step.
Create a password for the certificate and accept the default file name.

The output file is a keystore named elastic-certificates.p12. This file contains a node certificate, node key, and CA certificate.

On every node in your cluster, copy theelastic-certificates.p12 file to the $ES_PATH_CONF directory.

Encrypt internode communications with TLS

The transport networking layer is used for internal communication between nodes in a cluster. When security features are enabled, you must use TLS to ensure that communication between the nodes is encrypted.

Now that you’ve generated a certificate authority and certificates, you’ll update your cluster to use these files.

Elasticsearch monitors all files such as certificates, keys, keystores, or truststores that are configured as values of TLS-related node settings. If you update any of these files, such as when your hostnames change or your certificates are due to expire, Elasticsearch reloads them. The files are polled for changes at a frequency determined by the global Elasticsearch resource.reload.interval.high setting, which defaults to 5 seconds.

Complete the following steps for each node in your cluster. To join the same cluster, all nodes must share the same cluster.name value.

Open the $ES_PATH_CONF/elasticsearch.yml file and make the following changes:

Add the cluster-name setting and enter a name for your cluster:

cluster.name: my-cluster

Add the node.name setting and enter a name for the node. The node name defaults to the hostname of the machine when Elasticsearch starts.

node.name: node-1

Add the following settings to enable internode communication and provide access to the node’s certificate.

Because you are using the same elastic-certificates.p12 file on every node in your cluster, set the verification mode to certificate:

xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate 
xpack.security.transport.ssl.client_authentication: required
# xpack.security.transport.ssl.keystore.path: elastic-certificates.p12 官网有误修改如下
xpack.security.transport.ssl.keystore.path: elastic-stack-ca.p12
xpack.security.transport.ssl.truststore.path: elastic-certificates.p12

If you want to use hostname verification, set the verification mode to full. You should generate a different certificate for each host that matches the DNS or IP address. See the xpack.security.transport.ssl.verification_mode parameter in TLS settings.

If you entered a password when creating the node certificate, run the following commands to store the password in the Elasticsearch keystore:

./bin/elasticsearch-keystore add xpack.security.transport.ssl.keystore.secure_password 
./bin/elasticsearch-keystore add xpack.security.transport.ssl.truststore.secure_password

Complete the previous steps for each node in your cluster.
On every node in your cluster, restart Elasticsearch. The method for starting and stopping Elasticsearch varies depending on how you installed it.

For example, if you installed Elasticsearch with an archive distribution (tar.gz or .zip), you can enter Ctrl+C on the command line to stop Elasticsearch.

You must perform a full cluster restart. Nodes that are configured to use TLS for transport cannot communicate with nodes that use unencrypted transport connection (and vice-versa).

https://www.elastic.co/guide/en/elasticsearch/reference/7.16/security-basic-setup.html#encrypt-internode-communication