searchguard 在 Elasticsearch 2.x 上的运用

本节作者：wdh

本节内容基于以下软件版本：

  • elasticsearch 2.1.1-1
  • kibana 4.3.1
  • logstash 2.1.1-1

searchguard 2.x 更新后跟 shield 配置上很相似，相比之前的版本简洁很多。

searchguard 优点有：

  • 节点之间通过 SSL/TLS 传输
  • 支持 JDK SSL 和 Open SSL
  • 支持热载入，不需要重启服务
  • 支持 kibana4 及 logstash 的配置
  • 可以控制不同的用户访问不同的权限
  • 配置简单

安装

  1. 安装search-guard-ssl
  1. bin/plugin install com.floragunn/search-guard-ssl/2.1.1.5
  1. 安装search-guard-2
  1. bin/plugin install com.floragunn/search-guard-2/2.1.1.0-alpha2
  1. 配置 elasticsearch 支持 ssl

elasticsearch.yml增加以下配置：

  1. #############################################################################################
  2. #                                     SEARCH GUARD SSL                                      #
  3. #                                       Configuration                                       #
  4. #############################################################################################
  6. #This will likely change with Elasticsearch 2.2, see [PR 14108](https://github.com/elastic/elasticsearch/pull/14108)
  7. security.manager.enabled: false
  9. #############################################################################################
  10. # Transport layer SSL                                                                       #
  11. #                                                                                           #
  12. #############################################################################################
  14. # Enable or disable node-to-node ssl encryption (default: true)
  15. #searchguard.ssl.transport.enabled: false
  16. # JKS or PKCS12 (default: JKS)
  17. #searchguard.ssl.transport.keystore_type: PKCS12
  18. # Relative path to the keystore file (mandatory, this stores the server certificates), must be placed under the config/ dir
  19. searchguard.ssl.transport.keystore_filepath: node0-keystore.jks
  20. # Alias name (default: first alias which could be found)
  21. searchguard.ssl.transport.keystore_alias: my_alias
  22. # Keystore password (default: changeit)
  23. searchguard.ssl.transport.keystore_password: changeit
  25. # JKS or PKCS12 (default: JKS)
  26. #searchguard.ssl.transport.truststore_type: PKCS12
  27. # Relative path to the truststore file (mandatory, this stores the client/root certificates), must be placed under the config/ dir
  28. searchguard.ssl.transport.truststore_filepath: truststore.jks
  29. # Alias name (default: first alias which could be found)
  30. searchguard.ssl.transport.truststore_alias: my_alias
  31. # Truststore password (default: changeit)
  32. searchguard.ssl.transport.truststore_password: changeit
  33. # Enforce hostname verification (default: true)
  34. #searchguard.ssl.transport.enforce_hostname_verification: true
  35. # If hostname verification specify if hostname should be resolved (default: true)
  36. #searchguard.ssl.transport.resolve_hostname: true
  37. # Use native Open SSL instead of JDK SSL if available (default: true)
  38. #searchguard.ssl.transport.enable_openssl_if_available: false
  40. #############################################################################################
  41. # HTTP/REST layer SSL                                                                       #
  42. #                                                                                           #
  43. #############################################################################################
  44. # Enable or disable rest layer security - https, (default: false)
  45. #searchguard.ssl.http.enabled: true
  46. # JKS or PKCS12 (default: JKS)
  47. #searchguard.ssl.http.keystore_type: PKCS12
  48. # Relative path to the keystore file (this stores the server certificates), must be placed under the config/ dir
  49. #searchguard.ssl.http.keystore_filepath: keystore_https_node1.jks
  50. # Alias name (default: first alias which could be found)
  51. #searchguard.ssl.http.keystore_alias: my_alias
  52. # Keystore password (default: changeit)
  53. #searchguard.ssl.http.keystore_password: changeit
  54. # Do the clients (typically the browser or the proxy) have to authenticate themself to the http server, default is false
  55. #searchguard.ssl.http.enforce_clientauth: false
  56. # JKS or PKCS12 (default: JKS)
  57. #searchguard.ssl.http.truststore_type: PKCS12
  58. # Relative path to the truststore file (this stores the client certificates), must be placed under the config/ dir
  59. #searchguard.ssl.http.truststore_filepath: truststore_https.jks
  60. # Alias name (default: first alias which could be found)
  61. #searchguard.ssl.http.truststore_alias: my_alias
  62. # Truststore password (default: changeit)
  63. #searchguard.ssl.http.truststore_password: changeit
  64. # Use native Open SSL instead of JDK SSL if available (default: true)
  65. #searchguard.ssl.http.enable_openssl_if_available: false
  1. 增加 searchguard 的管理员帐号配置，同样在 elasticsearch.yml 中，增加以下配置：
  1. security.manager.enabled: false
  2. searchguard.authcz.admin_dn:
  3.   - "CN=admin,OU=client,O=client,l=tEst,C=De" #DN
  1. 重启 elasticsearch

将 node 证书和根证书放在 elasticsearch 配置文件目录下，证书可用 openssl 生成，修改了下官方提供的脚本。

注意：证书中的 client 的 DN 及 server 的 oid，证书不正确会导致 es 服务起不来。（我曾经用 ejbca 生成证书不能使用）

配置

searchguard 主要有5个配置文件在 plugins/search-guard-2/sgconfig 下：

  1. sg_config.yml:

主配置文件不需要做改动

  1. sg_internal_users.yml:

user 文件，定义用户。对于 ELK 我们需要一个 kibana 登录用户和一个 logstash 用户：

  1. kibana4:
  2.   hash: $2a$12$xZOcnwYPYQ3zIadnlQIJ0eNhX1ngwMkTN.oMwkKxoGvDVPn4/6XtO
  3.   #password is: kirk
  4.   roles:
  5.     - kibana4
  6. logstash:
  7.   hash: $2a$12$xZOcnwYPYQ3zIadnlQIJ0eNhX1ngwMkTN.oMwkKxoGvDVPn4/6XtO

密码可用plugins/search-guard-2/tools/hash.sh生成

  1. sg_roles.yml:

权限配置文件，这里提供 kibana4 和 logstash 的权限，以下是我修改后的内容，可自行修改该部分内容（插件安装自带的配置文件中权限不够，kibana 会登录不了，shield 中同样的权限却是够了）：

  1. sg_kibana4:
  2.   cluster:
  3.       - cluster:monitor/nodes/info
  4.       - cluster:monitor/health
  5.   indices:
  6.     '*':
  7.       '*':
  8.         - indices:admin/mappings/fields/get
  9.         - indices:admin/validate/query
  10.         - indices:data/read/search
  11.         - indices:data/read/msearch
  12.         - indices:admin/get
  13.         - indices:data/read/field_stats
  14.     '?kibana':
  15.       '*':
  16.         - indices:admin/exists
  17.         - indices:admin/mapping/put
  18.         - indices:admin/mappings/fields/get
  19.         - indices:admin/refresh
  20.         - indices:admin/validate/query
  21.         - indices:data/read/get
  22. sg_logstash:
  23.   cluster:
  24.     - indices:admin/template/get
  25.     - indices:admin/template/put
  26.   indices:
  27.     'logstash-*':
  28.       '*':
  29.         - WRITE
  30.         - indices:data/write/bulk
  31.         - indices:data/write/delete
  32.         - indices:data/write/update
  33.         - indices:data/read/search
  34.         - indices:data/read/scroll
  35.         - CREATE_INDEX
  1. sg_roles_mapping.yml:

定义用户的映射关系，添加 kibana 及 logstash 用户对应的映射：

  1. sg_logstash:
  2.   users:
  3.     - logstash
  4. sg_kibana4:
  5.   backendroles:
  6.     - kibana
  7.   users:
  8.     - kibana4
  1. sg_action_groups.yml:

定义权限

加载配置并启用

  1. plugins/search-guard-2/tools/sgadmin.sh -cd plugins/search-guard-2/sgconfig/ -ks plugins/search-guard-2/sgconfig/admin-keystore.jks -ts plugins/search-guard-2/sgconfig/truststore.jks  -nhnv

（如修改了密码，则需要使用plugins/search-guard-2/tools/sgadmin.sh -h查看对应参数）

注意证书路径，将生成的admin证书和根证书放在sgconfig目录下。

最后，可以尝试登录啦！

登录界面会有验证

帐号：kibana4 密码：kirk

更多的权限配置可以自己研究。

请参考

https://github.com/floragunncom/search-guard/tree/2.1.1