ElasticSearch 集群添加用户安全认证功能（设置访问密码）

前言

在6.8之前免费版本并不包含安全认证功能，之后版本有开放一些基础认证功能；为了防止各种事故，一般都会设置es集群的访问密码；但是在我尝试设置访问密码的时候发现，设置访问密码的前提必须要设置集群证书，不然es启动报错。

关于设置证书的作用，简单来说就是在集群内定各个es节点都必须持有相同的证书，如果某个es的恶意节点想加入你的集群，那么它也必须有要相同的证书，这就可以防止别人恶意创建节点加入你的集群了。本例子使用elasticsearchv7.2.0为例

（1）生成 TLS 和身份验证

将会在 config 下生成 elastic-certificates.p12 文件，将此文件传到其他两个节点的 config 目录，注意文件权限（一路回车即可，使用默认的即可）

[estestuser@vm-10-20-30-40 elasticsearch-7.1.1]$ bin/elasticsearch-certutil cert -out config/elastic-certificates.p12 -pass ""
WARNING: An illegal reflective access operation has occurred
WARNING: Illegal reflective access by org.bouncycastle.jcajce.provider.drbg.DRBG (file:/home/estestuser/elasticsearch-7.1.1/lib/tools/security-cli/bcprov-jdk15on-1.61.jar) to constructor sun.security.provider.Sun()
WARNING: Please consider reporting this to the maintainers of org.bouncycastle.jcajce.provider.drbg.DRBG
WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
WARNING: All illegal access operations will be denied in a future release
This tool assists you in the generation of X.509 certificates and certificate
signing requests for use with SSL/TLS in the Elastic stack.

The 'cert' mode generates X.509 certificate and private keys.
* By default, this generates a single certificate and key for use
on a single instance.
* The '-multiple' option will prompt you to enter details for multiple
instances and will generate a certificate and key for each one
* The '-in' option allows for the certificate generation to be automated by describing
the details of each instance in a YAML file

* An instance is any piece of the Elastic Stack that requires a SSL certificate.
Depending on your configuration, Elasticsearch, Logstash, Kibana, and Beats
may all require a certificate and private key.
* The minimum required value for each instance is a name. This can simply be the
hostname, which will be used as the Common Name of the certificate. A full
distinguished name may also be used.
* A filename value may be required for each instance. This is necessary when the
name would result in an invalid file or directory name. The name provided here
is used as the directory name (within the zip) and the prefix for the key and
certificate files. The filename is required if you are prompted and the name
is not displayed in the prompt.
* IP addresses and DNS names are optional. Multiple values can be specified as a
comma separated string. If no IP addresses or DNS names are provided, you may
disable hostname verification in your SSL configuration.

* All certificates generated by this tool will be signed by a certificate authority (CA).
* The tool can automatically generate a new CA for you, or you can provide your own with the
-ca or -ca-cert command line options.

By default the 'cert' mode produces a single PKCS#12 output file which holds:
* The instance certificate
* The private key for the instance certificate
* The CA certificate

If you specify any of the following options:
* -pem (PEM formatted output)
* -keep-ca-key (retain generated CA key)
* -multiple (generate multiple certificates)
* -in (generate certificates from an input file)
then the output will be be a zip file containing individual certificate/key files

Certificates written to /home/estestuser/elasticsearch-7.1.1/config/elastic-certificates.p12

This file should be properly secured as it contains the private key for
your instance.

This file is a self contained file and can be copied and used 'as is'
For each Elastic product that you wish to configure, you should copy
this '.p12' file to the relevant configuration directory
and then follow the SSL configuration instructions in the product guide.

上述操作完成之后，在 config 路径下会生成证书 elastic-certificates.p12，如下所示：

[estestuser@vm-10-20-30-40 elasticsearch-7.1.1]$ cd config/
[estestuser@vm-10-20-30-40 config]$ ll
total 48
-rw------- 1 estestuser estestuser 3443 Feb 24 09:31 elastic-certificates.p12
-rw-rw---- 1 estestuser estestuser 199 Feb 23 15:45 elasticsearch.keystore
-rw-rw---- 1 estestuser estestuser 3244 Feb 24 09:27 elasticsearch.yml
-rw-rw---- 1 estestuser estestuser 3544 Feb 23 16:15 jvm.options
-rw-rw---- 1 estestuser estestuser 17170 May 23 2019 log4j2.properties
-rw-rw---- 1 estestuser estestuser 473 May 23 2019 role_mapping.yml
-rw-rw---- 1 estestuser estestuser 197 May 23 2019 roles.yml
-rw-rw---- 1 estestuser estestuser 0 May 23 2019 users
-rw-rw---- 1 estestuser estestuser 0 May 23 2019 users_roles

将节点 1 上的证书依次拷贝到其他节点：

[estestuser@vm-10-20-30-40 config]$ scp elastic-certificates.p12 estestuser@10.20.30.41:/home/estestuser/elasticsearch-7.1.1/config/
estestuser@10.20.30.41's password:
elastic-certificates.p12 100% 3443 2.8MB/s 00:00
[estestuser@vm-10-20-30-40 config]$ scp elastic-certificates.p12 estestuser@10.20.30.42:/home/estestuser/elasticsearch-7.1.1/config/
estestuser@10.20.30.42's password:
elastic-certificates.p12 100% 3443 3.1MB/s 00:00

（2）新增配置，每个集群节点都需要设置。

编辑 elasticsearch.yml 文件：

[estestuser@vm-10-20-30-40 config]$ vi elasticsearch.yml

追加如下内容：

xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: elastic-certificates.p12

（3）重启 ES 集群

ES 集群不启动，下面的添加密码操作执行不了，所以依次重启 3 个节点。首先重启节点 1。

[estestuser@vm-10-20-30-40 config]$ ps -ef|grep elasticsearch
estestu+ 10370 8753 0 09:34 pts/0 00:00:00 grep --color=auto elasticsearch
estestu+ 31979 1 0 Feb23 ? 00:02:21 /home/estestuser/elasticsearch-7.1.1/jdk/bin/java -Xms1g -Xmx1g -XX:+UseParallelGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -Des.networkaddress.cache.ttl=60 -Des.networkaddress.cache.negative.ttl=10 -XX:+AlwaysPreTouch -Xss1m -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djna.nosys=true -XX:-OmitStackTraceInFastThrow -Dio.netty.noUnsafe=true -Dio.netty.noKeySetOptimization=true -Dio.netty.recycler.maxCapacityPerThread=0 -Dlog4j.shutdownHookEnabled=false -Dlog4j2.disable.jmx=true -Djava.io.tmpdir=/tmp/elasticsearch-2970892740801116994 -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=data -XX:ErrorFile=logs/hs_err_pid%p.log -Xlog:gc*,gc+age=trace,safepoint:file=logs/gc.log:utctime,pid,tags:filecount=32,filesize=64m -Djava.locale.providers=COMPAT -Dio.netty.allocator.type=unpooled -Des.path.home=/home/estestuser/elasticsearch-7.1.1 -Des.path.conf=/home/estestuser/elasticsearch-7.1.1/config -Des.distribution.flavor=default -Des.distribution.type=tar -Des.bundled_jdk=true -cp /home/estestuser/elasticsearch-7.1.1/lib/* org.elasticsearch.bootstrap.Elasticsearch -d
estestu+ 32017 31979 0 Feb23 ? 00:00:00 /home/estestuser/elasticsearch-7.1.1/modules/x-pack-ml/platform/linux-x86_64/bin/controller
[estestuser@vm-10-20-30-40 config]$ kill -9 31979
[estestuser@vm-10-20-30-40 config]$ ps -ef|grep elasticsearch
estestu+ 10406 8753 0 09:34 pts/0 00:00:00 grep --color=auto elasticsearch
[estestuser@vm-10-20-30-40 config]$ cd ../
[estestuser@vm-10-20-30-40 elasticsearch-7.1.1]$ bin/elasticsearch -d

依次重启节点 2 和节点 3。

（4）创建 Elasticsearch 集群密码

在节点 1 上执行如下命令，设置用户密码。设置完之后，数据会自动同步到其他节点。

[estestuser@vm-10-20-30-40 elasticsearch-7.1.1]$ bin/elasticsearch-setup-passwords interactive
Initiating the setup of passwords for reserved users elastic,apm_system,kibana,logstash_system,beats_system,remote_monitoring_user.
You will be prompted to enter passwords as the process progresses.
Please confirm that you would like to continue [y/N]y

Enter password for [elastic]:
Reenter password for [elastic]:
Enter password for [apm_system]:
Reenter password for [apm_system]:
Enter password for [kibana]:
Reenter password for [kibana]:
Enter password for [logstash_system]:
Reenter password for [logstash_system]:
Enter password for [beats_system]:
Reenter password for [beats_system]:
Enter password for [remote_monitoring_user]:
Reenter password for [remote_monitoring_user]:
Changed password for user [apm_system]
Changed password for user [kibana]
Changed password for user [logstash_system]
Changed password for user [beats_system]
Changed password for user [remote_monitoring_user]
Changed password for user [elastic]

（5）访问验证

再次无密码访问 elasticsearch，发现提示安全认证错误。

[estestuser@vm-10-20-30-40 elasticsearch-7.1.1]$ curl http://localhost:9200
{"error":{"root_cause":[{"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{"WWW-Authenticate":"Basic realm=\"security\" charset=\"UTF-8\""}}],"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{"WWW-Authenticate":"Basic realm=\"security\" charset=\"UTF-8\""}},"status":401}

输入帐号：elastic，密码：testpassword（此密码非真实密码，仅为了写博客记录），再次访问，发现成功。

[estestuser@vm-10-20-30-40 elasticsearch-7.1.1]$ curl --user elastic:testpassword http://localhost:9200
{
"name" : "node-1",
"cluster_name" : "my-application",
"cluster_uuid" : "l-kTWdoxRCuTIm6x8ekG7w",
"version" : {
"number" : "7.1.1",
"build_flavor" : "default",
"build_type" : "tar",
"build_hash" : "7a013de",
"build_date" : "2019-05-23T14:04:00.380842Z",
"build_snapshot" : false,
"lucene_version" : "8.0.0",
"minimum_wire_compatibility_version" : "6.8.0",
"minimum_index_compatibility_version" : "6.0.0-beta1"
},
"tagline" : "You Know, for Search"
}

上述访问方式为明文密码输入，不推荐，可以改为如下方式访问。

[estestuser@vm-10-20-30-40 elasticsearch-7.1.1]$ curl --user elastic http://localhost:9200
Enter host password for user 'elastic':
{
"name" : "node-1",
"cluster_name" : "my-application",
"cluster_uuid" : "l-kTWdoxRCuTIm6x8ekG7w",
"version" : {
"number" : "7.1.1",
"build_flavor" : "default",
"build_type" : "tar",
"build_hash" : "7a013de",
"build_date" : "2019-05-23T14:04:00.380842Z",
"build_snapshot" : false,
"lucene_version" : "8.0.0",
"minimum_wire_compatibility_version" : "6.8.0",
"minimum_index_compatibility_version" : "6.0.0-beta1"
},
"tagline" : "You Know, for Search"
}