elasticsearch 6.8 X-pack授权

爱睡懒觉的熊

已于 2022-12-12 09:58:18 修改

阅读量905

点赞数

分类专栏： es 文章标签： elasticsearch 大数据

于 2022-12-05 10:38:12 首次发布

本文链接：https://blog.youkuaiyun.com/weixin_52173654/article/details/128182664

版权

es 专栏收录该内容

2 篇文章

订阅专栏

本文介绍如何在Elasticsearch 6.8.0版本中启用并配置X-Pack的安全功能，包括设置用户密码、验证访问权限及测试认证流程。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

由于最近在弄等保测评，使用的组件用到了elasticsearch，漏扫出来未授权。这篇文章主要说明如何授权elasticsearch。
本文章使用的是6.8.0版本，内置已经带有X-pack我们只需要启用一下就可以、如果你用的版本没有自带x-pack就需要安装一下

[root@VM-4-11-centos elasticsearch]# bin/elasticsearch-plugin install x-pack
ERROR: this distribution of Elasticsearch contains X-Pack by default

1.修改elasticsearch.yml

xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true

2.重制登陆权限密码

[root@VM-4-11-centos elasticsearch]# bin/elasticsearch-setup-passwords interactive
Initiating the setup of passwords for reserved users elastic,apm_system,kibana,logstash_system,beats_system,remote_monitoring_user.
You will be prompted to enter passwords as the process progresses.
Please confirm that you would like to continue [y/N]y


Enter password for [elastic]: 
Reenter password for [elastic]: 
Enter password for [apm_system]: 
Reenter password for [apm_system]: 
Enter password for [kibana]: 
Reenter password for [kibana]: 
Enter password for [logstash_system]: 
Reenter password for [logstash_system]: 
Enter password for [beats_system]: 
Reenter password for [beats_system]: 
Enter password for [remote_monitoring_user]: 
Reenter password for [remote_monitoring_user]: 
Changed password for user [apm_system]
Changed password for user [kibana]
Changed password for user [logstash_system]
Changed password for user [beats_system]
Changed password for user [remote_monitoring_user]
Changed password for user [elastic]
[root@VM-4-11-centos elasticsearch]#

3.测试es未授权访问

[root@VM-4-11-centos elasticsearch]# curl 192.168.100.100:9200
{"error":{"root_cause":[{"type":"security_exception","reason":"missing authentication token for REST request [/]","header":{"WWW-Authenticate":"Basic realm=\"security\" charset=\"UTF-8\""}}],"type":"security_exception","reason":"missing authentication token for REST request [/]","header":{"WWW-Authenticate":"Basic realm=\"security\" charset=\"UTF-8\""}},"status":401}[root@VM-4-11-centos elasticsearch]#

4.测试带用户名密码访问

[root@VM-4-11-centos elasticsearch]# curl -u elastic:admin 192.168.100.100:9200
{
  "name" : "node-1",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "y4KynVkkQIO-9Lao5M0VBA",
  "version" : {
    "number" : "6.8.0",
    "build_flavor" : "default",
    "build_type" : "tar",
    "build_hash" : "65b6179",
    "build_date" : "2019-05-15T20:06:13.172855Z",
    "build_snapshot" : false,
    "lucene_version" : "7.7.0",
    "minimum_wire_compatibility_version" : "5.6.0",
    "minimum_index_compatibility_version" : "5.0.0"
  },
  "tagline" : "You Know, for Search"
}