es安全组端口_elasticsearch 服务安全配置

一、安装search guard插件必须要安装两部分：

①search-guard-xx

②search-guard-ssl

(XX指的是与elasticsearch引擎对应的版本)

github地址：

https://github.com/floragunncom/search-guard

这里以elasticsearch 2.3.5版本为例

进入到elasticsearch安装目录(如果是用RPM包安装的，默认位置是，也可用命令whereis elasticsearch查看安装位置)

cd /usr/share/elasticsearch

安装方法：

(1)search-guard

elasticsearch版本：elasticsearch 2.x

bin/plugin install -b com.floragunn/search-guard-2/

elasticsearch 2.3.5版本：

bin/plugin install -b com.floragunn/search-guard-2/2.3.5.10

elasticsearch版本：elasticsearch 5.x

bin/elasticsearch-plugin install -b com.floragunn:search-guard-5:

(2)search-guard-ssl

elasticsearch 2.x

bin/plugin install -b com.floragunn/search-guard-ssl/

elasticsearch 2.3.5版本：

bin/plugin install -b com.floragunn/search-guard-ssl/2.3.5.19

elasticsearch 5.x

bin/elasticsearch-plugin install -b com.floragunn:search-guard-ssl:

注意事项：

当es的版本大于2.2时，安装过程中可能会有如下提示：

这个是正常现象，只要看到有以下提示就表示安装成功：

Installed search-guard-ssl into /usr/share/elasticsearch/plugins/search-guard-ssl

Installed search-guard-2 into /usr/share/elasticsearch/plugins/search-guard-2

二、生成证书文件

1.下载search guard 源码工具，里面包含证书生成工具

git clone https://github.com/floragunncom/search-guard-ssl.git

2.切换到search guard ssl 源码目录，进入example-pki-scripts文件夹，里面有3个脚本

cd search-guard-ssl/example-pki-script