安裝Search Guard

和其他的elastic插件安裝方式相同，使用elasticsearch-plugin安裝search guard

在線安裝

需要將<version>替換為和當(dāng)前es環(huán)境匹配的版本

bin/elasticsearch-plugin install -b com.floragunn:search-guard-6:<version>

例如：

bin/elasticsearch-plugin install -b com.floragunn:search-guard-6:6.6.2-24.2

具體版本號見查詢地址：search-guard-versions

離線安裝

從search-guard-versions下載安裝包，使用如下命令：

[@djt_46_221 elasticsearch-6.6.1]# ./bin/elasticsearch-plugin install -b file:///search/odin/app/search-guard-6-6.6.1-24.2.zip
-> Downloading file:///search/odin/app/search-guard-6-6.6.1-24.2.zip
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@     WARNING: plugin requires additional permissions     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
* java.io.FilePermission /proc/sys/net/core/somaxconn read
* java.lang.RuntimePermission accessClassInPackage.com.sun.jndi.ldap
...
* javax.security.auth.AuthPermission modifyPrivateCredentials
* javax.security.auth.kerberos.ServicePermission * accept
See http://docs.oracle.com/javase/8/docs/technotes/guides/security/permissions.html
for descriptions of what these permissions allow and the associated risks.
-> Installed search-guard-6

修改elasticsearch.yml配置

這個(gè)地方用到了證書，有幾種生成證書的方式，可以在線生成tls-certificate-generator，也可以使用Search Guard TLS Tool，測試環(huán)境使用在線的方式比較簡單，將生成的壓縮包下載即可

在elasticsearch.yml增加如下配置，配置內(nèi)容參照readme.txt，用節(jié)點(diǎn)主機(jī)名替換 [hostname]部分 私鑰和密碼替換 [key password for this node]

searchguard.ssl.transport.pemcert_filepath: CN=[hostname].crtfull.pem
searchguard.ssl.transport.pemkey_filepath: CN=[hostname].key.pem
searchguard.ssl.transport.pemkey_password: [private key password for this node]
searchguard.ssl.transport.pemtrustedcas_filepath: chain-ca.pem
searchguard.ssl.transport.enforce_hostname_verification: false
searchguard.ssl.http.enabled: true
searchguard.ssl.http.pemcert_filepath: CN=[hostname].crtfull.pem
searchguard.ssl.http.pemkey_filepath: CN=[hostname].key.pem
searchguard.ssl.http.pemkey_password: [private key password for this node]
searchguard.ssl.http.pemtrustedcas_filepath: chain-ca.pem
                                                             
searchguard.authcz.admin_dn:                                
  - CN=sgadmin  
  

######## Start Search Guard Configuration ########
searchguard.ssl.transport.pemcert_filepath: key/node-certificates/CN=IP-10.138.46.221.crtfull.pem
searchguard.ssl.transport.pemkey_filepath: key/node-certificates/CN=IP-10.138.46.221.key.pem
searchguard.ssl.transport.pemkey_password: 212be8d21c4403816e67
searchguard.ssl.transport.pemtrustedcas_filepath: key/chain-ca.pem
searchguard.ssl.transport.enforce_hostname_verification: false
searchguard.ssl.http.enabled: true
searchguard.ssl.http.pemcert_filepath: key/node-certificates/CN=IP-10.138.46.221.crtfull.pem
searchguard.ssl.http.pemkey_filepath: key/node-certificates/CN=IP-10.138.46.221.key.pem
searchguard.ssl.http.pemkey_password: 212be8d21c4403816e67
searchguard.ssl.http.pemtrustedcas_filepath: key/chain-ca.pem

searchguard.authcz.admin_dn:
  - CN=sgadmin

searchguard.audit.type: internal_elasticsearch
searchguard.enable_snapshot_restore_privilege: true
searchguard.check_snapshot_restore_write_privileges: true
searchguard.restapi.roles_enabled: ["sg_all_access"]
cluster.routing.allocation.disk.threshold_enabled: false
discovery.zen.minimum_master_nodes: 1
node.max_local_storage_nodes: 3
xpack.security.enabled: false

######## End Search Guard Configuration ########

完成后啟動elasticsearch

sgadmin

如果要執(zhí)行sgadmin命令的話，需要將證書生成壓縮包中的以下文件

• root-ca.pem
• client-certificates/CN=sgadmin.crtfull.pem
• client-certificates/CN=sgadmin.key.pem
  拷貝到
  plugins/search-guard-<version>/tools

切換到plugins/search-guard-<version>/tools目錄

chmod 755 ./sgadmin.sh
./sgadmin.sh -cacert root-ca.pem -cert CN=sgadmin.crtfull.pem -key CN=sgadmin.key.pem -keypass b0ecfa16c57aa1cdf646 -nhnv -icl -cd ../sgconfig/

顯示如下內(nèi)容

[@djt_46_221 tools]# ./sgadmin.sh -cacert root-ca.pem -cert CN=sgadmin.crtfull.pem -key CN=sgadmin.key.pem -keypass b0ecfa16c57aa1cdf646 -nhnv -icl -cd ../sgconfig/
Search Guard Admin v6
Will connect to localhost:9300 ... done
Elasticsearch Version: 6.6.1
Search Guard Version: 6.6.1-24.2
Connected as CN=sgadmin
Contacting elasticsearch cluster 'elasticsearch' and wait for YELLOW clusterstate ...
Clustername: pingz
Clusterstate: YELLOW
Number of nodes: 1
Number of data nodes: 1
searchguard index already exists, so we do not need to create one.
Populate config from /search/odin/app/elasticsearch-6.6.1/plugins/search-guard-6/sgconfig
Will update 'sg/config' with ../sgconfig/sg_config.yml 
   SUCC: Configuration for 'config' created or updated
Will update 'sg/roles' with ../sgconfig/sg_roles.yml 
   SUCC: Configuration for 'roles' created or updated
Will update 'sg/rolesmapping' with ../sgconfig/sg_roles_mapping.yml 
   SUCC: Configuration for 'rolesmapping' created or updated
Will update 'sg/internalusers' with ../sgconfig/sg_internal_users.yml 
   SUCC: Configuration for 'internalusers' created or updated
Will update 'sg/actiongroups' with ../sgconfig/sg_action_groups.yml 
   SUCC: Configuration for 'actiongroups' created or updated
Done with success