ELK实时分析系统搭建之searchguard插件安装配置

摘要: searchguard插件安装配置

Searchguard的部署与权限策略配置

实现用户访问es中日志需要登陆授权，不同用户访问不同索引，不授权的索引无法查看，分组控制不同rd查看各自业务的日志。
关于ELK搭建：http://my.oschina.net/lengchuan/blog/725355。

安装部署

安装

可以先下载官方的看看：https://github.com/floragunncom/search-guard/wiki/Search-Guard-Bundle

以下两个插件需要在集群中所有的节点上安装。

参考：https://github.com/floragunncom/search-guard

安装search-guard-ssl插件

ES 与SG SSL版本对应关系：https://github.com/floragunncom/search-guard-ssl/wiki

./bin/plugin install -b com.floragunn/search-guard-ssl/2.3.3.14

安装search-guard-2插件

./bin/plugin install -b com.floragunn/search-guard-2/2.3.3.3

配置

SSL证书

生成keystore和truststore
要使用SSL，需要在每个几点都配置密钥以及证书。在Linux和OSX上可以使用插件提供的脚本来生成。

脚本可以生成一个包含根证书的证书文件，这个文件可以用于ES集群中所有的节点，把文件复制到其它节点相应的目录下就可以了。

脚本也可以生成三个keystore文件，因为包含了节点自己的密钥信息，所以每个节点都必须生成自己的kestore文件。

脚本通过OpenSSL来生成所需的文件，因此需要安装OpenSSL，版本不能低于1.0.1k。

下载SG SSL
如果需要通过脚本来生成，需要下载SG SSL的源码，具体参考：https://github.com/floragunncom/search-guard-ssl-docs/blob/master/quickstart.md

$ git clone https://github.com/floragunncom/search-guard-ssl.gi $ cd search-guard-ssl/example-pki-scripts

运行脚本生成所需要的文件
如果需要按照自己的要求生成证书，需要修改脚本以及配置文件。

除了需要修改脚本的内容外，还需要修改search-guard-ssl/example-pki-scripts/etc/目录下的两个config文件，当然，也可以用其它的方式自己生成证书。

生成文件：

$ ./example.sh

生成管理员的keystore

$ ./gen_client_node_cert.sh admin changeit capass

命令会生成一个admin-keystore.jks的文件，把truststore.jks、admin-keystore.jks拷贝到${ES_HOME}/plugins/search-guard-2/sgconfig目录下，给plugins/search-guard-2/tools/sgadmin.sh执行权限

$ chmod +x plugins/search-guard-2/tools/sgadmin.sh

把truststore.jks文件复制到ES集群中各个节点config目录下，把node-*-keystore.jks文件复制到各个节点的config目录下。

配置SG SSL 插件
SG SSL 需要配置在config/elasticsearch.yml文件中，在elasticsearch.yml文件的末尾添加下面的内容：https://github.com/floragunncom/search-guard-ssl/blob/master/searchguard-ssl-config-template.yml

#############################################################################################
#                                     SEARCH GUARD SSL                                      #
#                                       Configuration                                       #
#############################################################################################

#############################################################################################
# Transport layer SSL                                                                       #
#                                                                                           #
#############################################################################################
# Enable or disable node-to-node ssl encryption (default: true)
searchguard.ssl.transport.enabled: true

# JKS or PKCS12 (default: JKS)
# searchguard.ssl.transport.keystore_type: PKCS12

# Relative path to the keystore file (mandatory, this stores the server certificates), must be placed under the config/ dir
searchguard.ssl.transport.keystore_filepath: node-0-keystore.jks

# Alias name (default: first alias which could be found)
# searchguard.ssl.transport.keystore_alias: my_alias

# Keystore password (default: changeit)
searchguard.ssl.transport.keystore_password: changeit

# JKS or PKCS12 (default: JKS)
# searchguard.ssl.transport.truststore_type: PKCS12

# Relative path to the truststore file (mandatory, this stores the client/root certificates), must be placed under the config/ dir
searchguard.ssl.transport.truststore_filepath: truststore.jks

# Alias name (default: trust all aliases)
# searchguard.ssl.transport.truststore_alias: my_alias

# Truststore password (default: changeit)
searchguard.ssl.transport.truststore_password: changeit
# Enforce hostname verification (default: true)
searchguard.ssl.transport.enforce_hostname_verification: false

# If hostname verification is enabled specify if hostname should be resolved (default: true)
searchguard.ssl.transport.resolve_hostname: false

# Use native Open SSL instead of JDK SSL if available (default: true)
# searchguard.ssl.transport.enable_openssl_if_available: false

# Enabled SSL cipher suites for transport protocol (only Java format is supported)
# WARNING: Expert setting, do only use if you know what you are doing
# If you set wrong values here this this could be a security risk
# searchguard.ssl.transport.enabled_ciphers:
#  - "TLS_DHE_RSA_WITH_AES_256_CBC_SHA"
#  - "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256"

# Enabled SSL protocols for transport protocol (only Java format is supported)
# WARNING: Expert setting, do only use if you know what you are doing
# If you set wrong values here this this could be a security risk
# searchguard.ssl.transport.enabled_protocols:
#  - "TLSv1.2"
#可以使用上面的默认配置或者不配置，如果使用jdk1.7，就像下面这样配置，
#TLSv1有安全风险，但是如果不配置，就连不上logstash，所有建议大家用jdk1.8
searchguard.ssl.transport.enabled_protocols:
- "TLSv1"
- "TLSv1.1"
- "TLSv1.2"

#############################################################################################
# HTTP/REST layer SSL                                                                       #
#                                                                                           #
#############################################################################################
# Enable or disable rest layer security - https, (default: false)
searchguard.ssl.http.enabled: true

# JKS or PKCS12 (default: JKS)
#searchguard.ssl.http.keystore_type: PKCS12

# Relative path to the keystore file (this stores the server certificates), must be placed under the config/ dir
searchguard.ssl.http.keystore_filepath: node-0-keystore.jks

# Alias name (default: first alias which could be found)
# searchguard.ssl.http.keystore_alias: my_alias

# Keystore password (default: changeit)
#searchguard.ssl.http.keystore_password: changeit

# Do the clients (typically the browser or the proxy) have to authenticate themself to the http server, default is OPTIONAL
# To enforce authentication use REQUIRE, to completely disable client certificates use NONE
#这个是配置客户端是否需要证书登录，我这里使用账号登录，就不配置了
#证书登录还存在一些小问题，暂时没有找到太好的解决办法
#searchguard.ssl.http.clientauth_mode: REQUIRE

# JKS or PKCS12 (default: JKS)
#searchguard.ssl.http.truststore_type: PKCS12

# Relative path to the truststore file (this stores the client certificates), must be placed under the config/ dir
earchguard.ssl.http.truststore_filepath: truststore.jks

# Alias name (default: first alias which could be found)
#searchguard.ssl.http.truststore_alias: my_alias

# Truststore password (default: changeit)
searchguard.ssl.http.truststore_password: changeit

# Use native Open SSL instead of JDK SSL if available (default: true)
#searchguard.ssl.http.enable_openssl_if_available: false

# Enabled SSL cipher suites for http protocol (only Java format is supported)
# WARNING: Expert setting, do only use if you know what you are doing
# If you set wrong values here this this could be a security risk
# searchguard.ssl.http.enabled_ciphers:
#  - "TLS_DHE_RSA_WITH_AES_256_CBC_SHA"
#  - "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256"

# Enabled SSL protocols for http protocol (only Java format is supported)
# WARNING: Expert setting, do only use if you know what you are doing
# If you set wrong values here this this could be a security risk
# searchguard.ssl.http.enabled_protocols:
#  - "TLSv1.2"
# 同上
searchguard.ssl.http.enabled_protocols:
- "TLSv1"
- "TLSv1.1"
- "TLSv1.2"

管理员账号配置
在config/elasticsearch.yml中添加：

searchguard.authcz.admin_dn:
- "CN=admin, OU=client, O=client, L=Test, C=DE"

初始化searchguard
不要少了这一步，不然会运行不了

启动ES:

$ ./bin/elasticsearch

初始化searchguard

$ plugins/search-guard-2/tools/sgadmin.sh -cd plugins/search-guard-2/sgconfig -ts plugins/search-guard-2/sgconfig/truststore.jks -ks  plugins/search-guard-2/sgconfig/admin-keystore.jks -kspass changeit -tspass changeit  -icl -nhnv

这里的-icl是忽略集群的名称，不加会报错。

到这里基本的配置就完成了，下面来来登录ES试试。

在浏览器添加CA证书
打开浏览器设置，在高级选项里找到关于证书的设置，然后导入我们的CA证书，也就是search-guard-ssl/example-pki-scripts/ca/root-ca.crt,然后就可以通过https://127.0.0.1:9200访问了，默认的admin用户，密码是admin。

logstash配置

如果需要让logstash支持ssl，还需要对logstash进行配置 我这里给出一个我自己的配置，更多的配置请参考官方文档。

root-ca.pem是我们生成的证书，这里需要使用绝对路径。

output {
# For detail config for elasticsearch as output,
# See: https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html elasticsearch {
user => "logstash"
password => "logstash"
ssl => true
ssl_certificate_verification => true
cacert => "/opt/ELK/logstash-2.3.3/config/keys/root-ca.pem"
action => "index"          #The operation on ES
hosts  => ["https://localhost:9200"]   #ElasticSearch host, can be array.
index => "logstash-test1-%{type}-%{+YYYY.MM.dd}"
document_type => "%{type}"        #The index to write data to.
}
}

kibana配置

这里我也只是给出我自己的配置，更多的配置请参考官方文档。

elasticsearch.url: "https://192.168.2.251:9200"
elasticsearch.ssl.ca: "/opt/ELK/kibana-4.5.1-linux-x64/config/keys/root-ca.pem"
elasticsearch.username: "kibanaserver"
elasticsearch.password: "kibanaserver"
elasticsearch.ssl.verify: true

好了，searcguard插件就安装好了，至于权限的配置，以后再做补充。