一、修改配置文件
cluster.name: es-cluster #集群名称
node.name: es-node1 #当前节点名称（集群唯一）
node.master: true #允许当前节点作为master主节点
node.data: true
#path.data: /data/elasticsearch-6.8.10/data #ES集群数据目录
#path.logs: /data/elasticsearch-6.8.10/logs #ES集群日志目录
network.host: 0.0.0.0 #配置0.0.0.0允许其他地址访问
http.port: 9200 #对外访问端口
transport.tcp.port: 9300
transport.tcp.compress: true
discovery.zen.ping.unicast.hosts: ["10.130.210.197","10.130.210.187","10.130.210.247"] #集群的所有节点的IP地址
discovery.zen.minimum_master_nodes: 2 #集群正常运行的节点数量，一般为半数+1
discovery.zen.ping_timeout: 3s #集群节点发现超时时间
http.cors.enabled: true #允许跨域访问
http.cors.allow-origin: "*"
#以下配置用于设置密码访问ES集群，如不需要可以不用
xpack.security.enabled: true
xpack.license.self_generated.type: basic
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: elastic-certificates.p12
二、生成 TLS 和身份验证，将会在 config 下生成 elastic-certificates.p12 文件，将此文件传到其他两个节点的 config 目录，注意文件权限
./elasticsearch-certutil cert -out config/elastic-certificates.p12 -pass ""
WARNING: An illegal reflective access operation has occurred
WARNING: Illegal reflective access by org.bouncycastle.jcajce.provider.drbg.DRBG (file:/home/estestuser/elasticsearch-7.1.1/lib/tools/security-cli/bcprov-jdk15on-1.61.jar) to constructor sun.security.provider.Sun()
WARNING: Please consider reporting this to the maintainers of org.bouncycastle.jcajce.provider.drbg.DRBG
WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
WARNING: All illegal access operations will be denied in a future release
This tool assists you in the generation of X.509 certificates and certificate
signing requests for use with SSL/TLS in the Elastic stack.
The 'cert' mode generates X.509 certificate and private keys.
* By default, this generates a single certificate and key for use
on a single instance.
* The '-multiple' option will prompt you to enter details for multiple
instances and will generate a certificate and key for each one
* The '-in' option allows for the certificate generation to be automated by describing
the details of each instance in a YAML file
* An instance is any piece of the Elastic Stack that requires a SSL certificate.
Depending on your configuration, Elasticsearch, Logstash, Kibana, and Beats
may all require a certificate and private key.
* The minimum required value for each instance is a name. This can simply be the
hostname, which will be used as the Common Name of the certificate. A full
distinguished name may also be used.
* A filename value may be required for each instance. This is necessary when the
name would result in an invalid file or directory name. The name provided here
is used as the directory name (within the zip) and the prefix for the key and
certificate files. The filename is required if you are prompted and the name
is not displayed in the prompt.
* IP addresses and DNS names are optional. Multiple values can be specified as a
comma separated string. If no IP addresses or DNS names are provided, you may
disable hostname verification in your SSL configuration.
* All certificates generated by this tool will be signed by a certificate authority (CA).
* The tool can automatically generate a new CA for you, or you can provide your own with the
-ca or -ca-cert command line options.
By default the 'cert' mode produces a single PKCS#12 output file which holds:
* The instance certificate
* The private key for the instance certificate
* The CA certificate
If you specify any of the following options:
* -pem (PEM formatted output)
* -keep-ca-key (retain generated CA key)
* -multiple (generate multiple certificates)
* -in (generate certificates from an input file)
then the output will be be a zip file containing individual certificate/key files
Certificates written to /home/estestuser/elasticsearch-7.1.1/config/elastic-certificates.p12
This file should be properly secured as it contains the private key for
your instance.
This file is a self contained file and can be copied and used 'as is'
For each Elastic product that you wish to configure, you should copy
this '.p12' file to the relevant configuration directory
and then follow the SSL configuration instructions in the product guide.
上述操作完成之后，在 config 路径下会生成证书 elastic-certificates.p12，如下所示：
[estestuser@vm-10-201-42-9 elasticsearch-7.1.1]$ cd config/
[estestuser@vm-10-201-42-9 config]$ ll
total 48
-rw------- 1 estestuser estestuser 3443 Feb 24 09:31 elastic-certificates.p12
-rw-rw---- 1 estestuser estestuser 199 Feb 23 15:45 elasticsearch.keystore
-rw-rw---- 1 estestuser estestuser 3244 Feb 24 09:27 elasticsearch.yml
-rw-rw---- 1 estestuser estestuser 3544 Feb 23 16:15 jvm.options
-rw-rw---- 1 estestuser estestuser 17170 May 23 2019 log4j2.properties
-rw-rw---- 1 estestuser estestuser 473 May 23 2019 role_mapping.yml
-rw-rw---- 1 estestuser estestuser 197 May 23 2019 roles.yml
-rw-rw---- 1 estestuser estestuser 0 May 23 2019 users
-rw-rw---- 1 estestuser estestuser 0 May 23 2019 users_roles
将节点 1 上的证书依次拷贝到其他节点：
[estestuser@vm-10-201-42-9 config]$ scp elastic-certificates.p12 estestuser@10.201.42.19:/home/estestuser/elasticsearch-7.1.1/config/
estestuser@10.201.42.19's password:
elastic-certificates.p12 100% 3443 2.8MB/s 00:00
[estestuser@vm-10-201-42-9 config]$ scp elastic-certificates.p12 estestuser@10.201.42.37:/home/estestuser/elasticsearch-7.1.1/config/
estestuser@10.201.42.37's password:
elastic-certificates.p12 100% 3443 3.1MB/s 00:00
三、重启集群所有节点
ES 集群不启动，下面的添加密码操作执行不了，所以依次重启 3 个节点。首先重启节点 1。
[estestuser@vm-10-201-42-9 config]$ ps -ef|grep elasticsearch
estestu+ 10370 8753 0 09:34 pts/0 00:00:00 grep --color=auto elasticsearch
estestu+ 31979 1 0 Feb23 ? 00:02:21 /home/estestuser/elasticsearch-7.1.1/jdk/bin/java -Xms1g -Xmx1g -XX:+UseParallelGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -Des.networkaddress.cache.ttl=60 -Des.networkaddress.cache.negative.ttl=10 -XX:+AlwaysPreTouch -Xss1m -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djna.nosys=true -XX:-OmitStackTraceInFastThrow -Dio.netty.noUnsafe=true -Dio.netty.noKeySetOptimization=true -Dio.netty.recycler.maxCapacityPerThread=0 -Dlog4j.shutdownHookEnabled=false -Dlog4j2.disable.jmx=true -Djava.io.tmpdir=/tmp/elasticsearch-2970892740801116994 -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=data -XX:ErrorFile=logs/hs_err_pid%p.log -Xlog:gc*,gc+age=trace,safepoint:file=logs/gc.log:utctime,pid,tags:filecount=32,filesize=64m -Djava.locale.providers=COMPAT -Dio.netty.allocator.type=unpooled -Des.path.home=/home/estestuser/elasticsearch-7.1.1 -Des.path.conf=/home/estestuser/elasticsearch-7.1.1/config -Des.distribution.flavor=default -Des.distribution.type=tar -Des.bundled_jdk=true -cp /home/estestuser/elasticsearch-7.1.1/lib/* org.elasticsearch.bootstrap.Elasticsearch -d
estestu+ 32017 31979 0 Feb23 ? 00:00:00 /home/estestuser/elasticsearch-7.1.1/modules/x-pack-ml/platform/linux-x86_64/bin/controller
[estestuser@vm-10-201-42-9 config]$ kill -9 31979
[estestuser@vm-10-201-42-9 config]$ ps -ef|grep elasticsearch
estestu+ 10406 8753 0 09:34 pts/0 00:00:00 grep --color=auto elasticsearch
[estestuser@vm-10-201-42-9 config]$ cd ../
[estestuser@vm-10-201-42-9 elasticsearch-7.1.1]$ bin/elasticsearch -d
四、创建 Elasticsearch 集群密码
在节点 1 上执行如下命令，设置用户密码。设置完之后，数据会自动同步到其他节点。
[estestuser@vm-10-201-42-9 elasticsearch-7.1.1]$ bin/elasticsearch-setup-passwords interactive
Initiating the setup of passwords for reserved users elastic,apm_system,kibana,logstash_system,beats_system,remote_monitoring_user.
You will be prompted to enter passwords as the process progresses.
Please confirm that you would like to continue [y/N]y
Enter password for [elastic]:
Reenter password for [elastic]:
Enter password for [apm_system]:
Reenter password for [apm_system]:
Enter password for [kibana]:
Reenter password for [kibana]:
Enter password for [logstash_system]:
Reenter password for [logstash_system]:
Enter password for [beats_system]:
Reenter password for [beats_system]:
Enter password for [remote_monitoring_user]:
Reenter password for [remote_monitoring_user]:
Changed password for user [apm_system]
Changed password for user [kibana]
Changed password for user [logstash_system]
Changed password for user [beats_system]
Changed password for user [remote_monitoring_user]
Changed password for user [elastic]
[estestuser@vm-10-201-42-9 elasticsearch-7.1.1]$
五、访问验证
再次无密码访问 elasticsearch，发现提示安全认证错误。
[estestuser@vm-10-201-42-9 elasticsearch-7.1.1]$ curl http://localhost:9200
{"error":{"root_cause":[{"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{"WWW-Authenticate":"Basic realm=\"security\" charset=\"UTF-8\""}}],"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{"WWW-Authenticate":"Basic realm=\"security\" charset=\"UTF-8\""}},"status":401}
输入用户密码访问成功
