Elasticsearch-7.6.1开启安全认证

ES-7.6.1开启安全认证

1.修改配置

/data01/elasticsearch-7.6.1/config/elasticsearch.yml

在文件最后添加

xpack.security.enabled: true

xpack.license.self_generated.type: basic

xpack.security.transport.ssl.enabled: true

xpack.security.transport.ssl.verification_mode: certificate

xpack.security.transport.ssl.client_authentication: required

xpack.security.transport.ssl.keystore.path: certs/elastic-certificates.p12

xpack.security.transport.ssl.truststore.path: certs/elastic-certificates.p12

2.创建目录

cd /data01/elasticsearch-7.6.1/config/

mkdir certs

3.生成ca证书（只在master生成）

bin/elasticsearch-certutil ca

选择默认路径 文件名 填写密码(可不写)

4.生成凭证（只在master生成）

bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12

选择默认路径 文件名 填写密码

分发到集群的其他机器上

scp elastic-certificates.p12 dqs04:/data01/elasticsearch-7.6.1/

scp elastic-certificates.p12 dqs03:/data01/elasticsearch-7.6.1/

并移动证书到指定目录下

mv elastic-certificates.p12 config/certs/

每台机器都得单独执行以下操作(注意下面的这一步如果错误的话是不会报错的 小心输入你的密码 保证和主机上输入的一致)

bin/elasticsearch-keystore add xpack.security.transport.ssl.keystore.secure_password

bin/elasticsearch-keystore add xpack.security.transport.ssl.truststore.secure_password

bin/elasticsearch-keystore remove xpack.security.transport.ssl.keystore.secure_password

bin/elasticsearch-keystore remove xpack.security.transport.ssl.truststore.secure_password

5.重启服务

jps | grep Elasticsearch |awk '{print $1}'| xargs kill -9

nohup ./elasticsearch  &

6.设置密码

/bin/elasticsearch-setup-passwords interactive     // 给用户一一设置密码             

bin/elasticsearch-setup-passwords auto          // 自动随机生成并设置密码

7.访问9200测试