docker+elk7.8实战之Elasticsearch安全配置与kibana配套修改

Elasticsearch修改

1.进入容器并生成p12文件

[root@localhost conf]# c'c'c
[root@7e2278353444 elasticsearch]# cd bin
[root@7e2278353444 bin]# elasticsearch-certutil ca
This tool assists you in the generation of X.509 certificates and certificate
signing requests for use with SSL/TLS in the Elastic stack.

The 'ca' mode generates a new 'certificate authority'
This will create a new X.509 certificate and private key that can be used
to sign certificate when running in 'cert' mode.

Use the 'ca-dn' option if you wish to configure the 'distinguished name'
of the certificate authority

By default the 'ca' mode produces a single PKCS#12 output file which holds:
    * The CA certificate
    * The CA's private key

If you elect to generate PEM format certificates (the -pem option), then the output will
be a zip file containing individual files for the CA certificate and private key

Please enter the desired output file [elastic-stack-ca.p12]: elastic-certificate.p12
Enter password for elastic-certificate.p12 : 
[root@7e2278353444 bin]# elasticsearch-keystore add xpack.security.transport.ssl.keystore.secure_password
Enter value for xpack.security.transport.ssl.keystore.secure_password: 
[root@7e2278353444 bin]# elasticsearch-keystore add xpack.security.transport.ssl.truststore.secure_password
Enter value for xpack.security.transport.ssl.truststore.secure_password: 
[root@7e2278353444 bin]# 

英文部分的大致意思如下:

​ ca 模式会生成一个包含CA证书和私钥的.p12文件，也可以通过选择-pem模式生成独立的证书和私钥文件

2.注册密码到keystore

[root@7e2278353444 bin]# elasticsearch-keystore add xpack.security.transport.ssl.keystore.secure_password
Enter value for xpack.security.transport.ssl.keystore.secure_password: 
[root@7e2278353444 bin]# elasticsearch-keystore add xpack.security.transport.ssl.truststore.secure_password
Enter value for xpack.security.transport.ssl.truststore.secure_password: 
[root@7e2278353444 bin]# 

注意:

​ 各个节点都需要执行,因为p12是同一个文件所以密码也是相同的，需要输入的密码即生成证书文件时输入的密码

3.复制p12文件到其他节点对应文件夹下

[root@7e2278353444 bin]# cd ..
[root@7e2278353444 elasticsearch]# ls -ll
total 572
-rw-r--r--  1 elasticsearch root  13675 Jul 21 16:38 LICENSE.txt
-rw-r--r--  1 elasticsearch root 544318 Jul 21 16:42 NOTICE.txt
-rw-r--r--  1 elasticsearch root   8165 Jul 21 16:38 README.asciidoc
drwxr-xr-x  2 elasticsearch root   4096 Jul 21 16:45 bin
drwxrwxrwx  2 root          root    105 Aug  7 08:17 config
drwxrwxrwx  3 root          root     19 Aug  3 13:47 data
-rw-------  1 root          root   2527 Aug  7 08:15 elastic-certificate.p12
drwxr-xr-x  1 elasticsearch root     17 Jul 21 16:43 jdk
drwxr-xr-x  3 elasticsearch root   4096 Jul 21 16:43 lib
drwxrwxrwx  2 root          root      6 Jul 29 12:44 logs
drwxr-xr-x 47 elasticsearch root   4096 Jul 21 16:44 modules
drwxr-xr-x  3 root          root     31 Aug  3 13:46 plugins
[root@7e2278353444 elasticsearch]# cp elastic-certificate.p12 config/
[root@7e2278353444 elasticsearch]# exit
exit
[root@localhost conf]# ls
elastic-certificate.p12  elasticsearch.keystore  elasticsearch.yml  jvm.options  log4j2.properties
[root@localhost conf]# chmod 777 -R elastic-certificate.p12 
[root@localhost conf]# cp elastic-certificate.p12 ../../es02/conf/
[root@localhost conf]# cp elastic-certificate.p12 ../../es03/conf/
[root@localhost conf]# cd ../../es02/conf/
[root@localhost conf]# ls -ll
总用量 20
-rwxr-xr-x 1 root root 2527 8月   7 16:47 elastic-certificate.p12
-rwxrwxrwx 1 root root  199 8月   3 21:05 elasticsearch.keystore
-rwxrwxrwx 1 root root 2064 8月   4 21:47 elasticsearch.yml
-rwxrwxrwx 1 root root   18 8月   6 21:36 jvm.options
-rwxrwxrwx 1 root root 1238 8月   3 21:05 log4j2.properties
[root@localhost conf]# chown -R 777 elastic-certificate.p12 
[root@localhost conf]# cd ../../es03/conf
[root@localhost conf]# chown -R 777 elastic-certificate.p12

4.修改配置文件

elasticsearch.yml (原配置文件后追加，各个节点都需要修改，添加的内容一致)

xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: elastic-certificate.p12
xpack.security.transport.ssl.truststore.path: elastic-certificate.p12

5.重新创建容器

[root@localhost conf]# docker rm -f es-01 es-02 es-03
es-01
es-02
es-03
[root@localhost conf]# free -m
              total        used        free      shared  buff/cache   available
Mem:           7301         693        4982          11        1624        6190
Swap:             0           0           0

# 重新创建容器命令
docker run -p 9200:9200 -p 9300:9300 --name es-01 \ 
-v /opt/elk7/es/es01/data01:/usr/share/elasticsearch/data \
-v /opt/elk7/es/es01/conf:/usr/share/elasticsearch/config \
-v /opt/elk7/es/es01/logs:/usr/share/elasticsearch/logs \
-v /opt/elk7/es/plugins:/usr/share/elasticsearch/plugins \
-d elasticsearch:7.8.1

docker run -p 9202:9202 -p 9302:9302 --name es-02 \ 
-v /opt/elk7/es/es02/data02:/usr/share/elasticsearch/data \
-v /opt/elk7/es/es02/conf:/usr/share/elasticsearch/config \
-v /opt/elk7/es/es02/logs:/usr/share/elasticsearch/logs \
-v /opt/elk7/es/plugins:/usr/share/elasticsearch/plugins \
-d elasticsearch:7.8.1

docker run -p 9203:9203 -p 9303:9303 --name es-03 \ 
-v /opt/elk7/es/es03/data03:/usr/share/elasticsearch/data \
-v /opt/elk7/es/es03/conf:/usr/share/elasticsearch/config \
-v /opt/elk7/es/es03/logs:/usr/share/elasticsearch/logs \
-v /opt/elk7/es/plugins:/usr/share/elasticsearch/plugins \
-d elasticsearch:7.8.1

6.设置内置用户密码

[root@localhost conf]# docker exec -it es-01 bash
[root@4c691d52b066 elasticsearch]# cd bin
[root@4c691d52b066 bin]# elasticsearch-setup-passwords interactive
Initiating the setup of passwords for reserved users elastic,apm_system,kibana,kibana_system,logstash_system,beats_system,remote_monitori
You will be prompted to enter passwords as the process progresses.
Please confirm that you would like to continue [y/N]y


Enter password for [elastic]: 
Reenter password for [elastic]: 
Enter password for [apm_system]: 
Reenter password for [apm_system]: 
Enter password for [kibana_system]: 
Reenter password for [kibana_system]: 
Enter password for [logstash_system]: 
Reenter password for [logstash_system]: 
Enter password for [beats_system]: 
Reenter password for [beats_system]: 
Enter password for [remote_monitoring_user]: 
Reenter password for [remote_monitoring_user]: 
Changed password for user [apm_system]
Changed password for user [kibana_system]
Changed password for user [kibana]
Changed password for user [logstash_system]
Changed password for user [beats_system]
Changed password for user [remote_monitoring_user]
Changed password for user [elastic]
[root@4c691d52b066 bin]# exit      

注意: 设置只能操作一次，再次操作就是更新密码了。

7.重启es集群

docker restart es-01 es-02 es-03

kibana修改

1.复制p12文件到kibana对应的文件夹

[root@localhost es]# cd es01/
[root@localhost es01]# ls
conf  data01  logs  plugins
[root@localhost es01]# cd conf
[root@localhost conf]# ls
elastic-certificate.p12  elasticsearch.keystore  elasticsearch.yml  jvm.options  log4j2.properties
[root@localhost conf]# cp elastic-certificate.p12 /opt/elk7/kibana/conf

2.修改kibana配置文件

elasticsearch.ssl.truststore.path: /usr/share/kibana/config/elastic-certificate.p12
elasticsearch.ssl.keystore.path: /usr/share/kibana/config/elastic-certificate.p12
elasticsearch.ssl.verificationMode: certificate
elasticsearch.username: kibana_system

3.添加密码到keystore

# 进入kibana容器内部
docker exec -it kibana bash
# 进入bin目录
cd bin
# 创建keystore
kibana-keystore create
# 添加对应的password
kibana-keystore add elasticsearch.ssl.truststore.password
kibana-keystore add elasticsearch.ssl.keystore.password
kibana-keystore add elasticsearch.password
exit

4.重新生成kibana容器

docker run -it -p 5601:5601 --name kibana \  
-v /opt/elk7/kibana/logs/kibana.log:/usr/share/kibana/logs/kibana.log \
-v /opt/elk7/kibana/data:/usr/share/kibana/data \
-v /opt/elk7/kibana/conf:/usr/share/kibana/config \
-d kibana:7.8.1

5.验证

1) kibana运行截图

登陆页面使用elastic和配置的密码进行登陆

2)登陆之后的页面

3)安全设置主界面及菜单

总结来说整体的操作顺序如下:

1.进入ES容器生成p12文件
2.添加密钥到elasticsearch.keystore
3.复制证书文件到各个节点并在每个节点执行步骤2
4.修改ES配置文件
5.重新生成容器并运行(需要挂在p12文件到正确的目录，
  也就是和配置文件中引用的地址对应)
6.设置ES内置账号的密码
7.配置kibana/logstash等其他组件