介绍

Elasticsearch 程序中提供elasticsearch-certutil命令来简化生成证书的过程。

该命令共有 3 种模式：

  • CA 模式，用于生成一个新的证书颁发机构。
  • CERT 模式，用于生成 X.509 证书和私钥。
  • CSR 模式，用于生成证书签名请求，该请求指向受信任的证书颁发机构以获取签名的证书。签名证书必须为 PEM 或 PKCS#12 格式，才能与 Elasticsearch 安全功能一起使用。

生成证书

certutil官方文档

如果集群部署, 想为每个node都配置ssl, 就改instance.yml和extra_hosts

参考: https://www.elastic.co/cn/blog/configuring-ssl-tls-and-https-to-secure-elasticsearch-kibana-beats-and-logstash

证书位置必须写绝对路径

  • 新建instance.yml以创建各容器的自签名证书
    1
    2
    3
    4
    5
    6
    7
    8
    9
    # name会对应到生成证书文件的路径名称
    # dns可以多个，对应其匹配域名
    instances:
      - name: 'es-node1'
        dns: ['node1.elastic.com']
      - name: 'logstash'
        dns: ['node1.logstash.com']
      - name: 'kibana'
        dns: ['kibana.com']
  • 拷贝到es容器
    1
    docker cp instance.yml elasticsearch:/usr/share/elasticsearch/
  • 进入es容器, 执行如下命令

    eg: 生成10年的证书

1
bin/elasticsearch-certutil cert ca --days 3650 --pem --in instance.yml --out certs.zip
  • 从容器拷贝到宿主机上
    1
    docker cp elasticsearch:/usr/share/elasticsearch/certs.zip /opt/elk/ssl
  • 解压
    1
    unzip certs.zip -d ./certs
  • 会解压出四个文件夹, 将ca文件夹下的ca.crt文件copy到另外四个目录下
    1
    2
    3
    4
    cd certs/
    cp ca.crt es-node1/
    cp ca.crt logstash/
    cp ca.crt kibana/

docker-compose.yml调整

  • es
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    elasticsearch:
      ...
      privileged: true
      ...
      volumes:
        ...
        # 修改此处路径映射
        # 宿主机路径：容器路径
        - /opt/elk/ssl/certs/es-node1:/usr/share/elasticsearch/config/certs
      ...
      extra_hosts:
        # 配置ip映射
        - "kibana.com:10.104.8.126"
        - "node1.logstash.com:10.104.8.126"
        - "node1.elastic.com:127.0.0.1"
        - "es-node1:127.0.0.1"
  • kibana
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    kibana:
      ...
      volumes:
        # 修改此处路径映射
        # 宿主机路径：容器路径
        - /opt/elk/ssl/certs/kibana:/usr/share/kibana/config/certs
      extra_hosts:
        # 配置ip映射
        - "kibana.com:127.0.0.1"
        - "node1.logstash.com:10.104.8.126"
        - "node1.elastic.com:10.104.8.126"
        - "es-node1:10.104.8.126"
  • logstash
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    logstash:
      ...
      volumes:
        # 修改此处路径映射
        # 宿主机路径：容器路径
        - /opt/elk/ssl/certs/logstash:/usr/share/logstash/config/certs
      extra_hosts:
        # 配置ip映射
        - "kibana.com:10.104.8.126"
        - "node1.logstash.com:127.0.0.1"
        - "node1.elastic.com:10.104.8.126"
        - "es-node1:10.104.8.126"

conf(conf配置文件)

  • kibana.yml
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    server.name: "kibana"
    server.host: "0.0.0.0"
    server.ssl.enabled: true
    # 证书,compose.yml配置中去看
    server.ssl.certificate: /usr/share/kibana/config/certs/kibana.crt
    # 证书,compose.yml配置中去看
    server.ssl.key: /usr/share/kibana/config/certs/kibana.key
    # 证书,compose.yml配置中去看
    elasticsearch.ssl.certificateAuthorities: ["/usr/share/kibana/config/certs/ca.crt"]
    # 这里有仨值,直接谷歌这个key看下解释
    # elasticsearch.ssl.verificationMode: none
    elasticsearch.hosts: ["https://node1.elastic.com:9200"]
    elasticsearch.username: kibana_system
    elasticsearch.password: xxx
    # 如果不写,每次回无法看到上次产出报的问题
    xpack.reporting.encryptionKey: fd7c75cf-6abd-4704-a614-10a8679d64e7
    # 下面这俩告警的
    monitoring.ui.enabled: true
    monitoring.ui.container.logstash.enabled: true
    # 这是一个关于沙盒相关的(具体会影响啥不太清楚,我只是为了关掉warning)
    xpack.reporting.capture.browser.chromium.disableSandbox: false
    # 外网访问地址
    server.publicBaseUrl: https://xxx:5601
    # 告警相关
    xpack.encryptedSavedObjects.encryptionKey: 554d5cab-b336-eb0a-e128-6c5012dcc330
    # 中文
    i18n.locale: "zh-CN"
  • elasticsearch.yml
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36
    37
    38
    39
    40
    41
    42
    43
    44
    # 集群名称
    cluster.name: elasticsearch-cluster
    # 节点名称
    node.name: es-node1
    # 绑定host，0.0.0.0代表当前节点的ip(这里别改,就全员就行)
    network.host: 0.0.0.0
    # 设置其它节点和该节点交互的ip地址，如果不设置它会自动判断，值必须是个真实的ip地址(本机ip)
    network.publish_host: node1.elastic.com
    # 设置对外服务的http端口，默认为9200
    http.port: 9200
    # 设置节点间交互的tcp端口，默认是9300
    transport.tcp.port: 9300
    # 是否支持跨域，默认为false
    http.cors.enabled: true
    # 当设置允许跨域，默认为*,表示支持所有域名，如果我们只是允许某些网站能访问，那么可以使用正则表达式。比如只允许本地地址。 /https?:\/\/localhost(:[0-9]+)?/
    http.cors.allow-origin: "*"
    discovery.type: single-node
    # 表示这个节点是否可以充当主节点
    node.master: true
    # 是否充当数据节点
    node.data: true
    # 所有主从节点ip:port(这里得改)
    discovery.seed_hosts: ["node1.elastic.com"]
    # 这里配了,然后不配discovery.type: single-node就会以集群方式启动
    # cluster.initial_master_nodes: ["es-node1"]
    # 这个参数决定了在选主过程中需要 有多少个节点通信  预防脑裂
    discovery.zen.minimum_master_nodes: 1
    # 跨域允许设置的头信息，默认为X-Requested-With,Content-Type,Content-Lengt
    http.cors.allow-headers: Authorization
    #锁内存，提前占用内存
    bootstrap.memory_lock: true
    # 这条配置表示开启xpack认证机制
    xpack.security.enabled: true
    # 下面这些都跟证书有关
    xpack.security.http.ssl.enabled: true
    xpack.security.transport.ssl.enabled: true
    xpack.security.http.ssl.key: /usr/share/elasticsearch/config/certs/es-node1.key
    xpack.security.http.ssl.certificate: /usr/share/elasticsearch/config/certs/es-node1.crt
    xpack.security.http.ssl.certificate_authorities: /usr/share/elasticsearch/config/certs/ca.crt
    xpack.security.transport.ssl.key: /usr/share/elasticsearch/config/certs/es-node1.key
    xpack.security.transport.ssl.certificate: /usr/share/elasticsearch/config/certs/es-node1.crt
    xpack.security.transport.ssl.certificate_authorities: /usr/share/elasticsearch/config/certs/ca.crt
    # 这里有仨值,直接谷歌这个key看下解释
    # xpack.security.transport.ssl.verification_mode: none
  • /usr/share/logstash/pipeline/conf.d/*.conf

    针对 Beats 输入插件，需要将 logstash.key 转换为 PKCS8 格式

    1
    openssl pkcs8 -in logstash.key -topk8 -nocrypt -out logstash.pkcs8.key
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    beats {
        port => 5044
        ssl => true
        ssl_key => '/usr/share/logstash/config/certs/logstash.pkcs8.key'
        ssl_certificate => '/usr/share/logstash/config/certs/logstash.crt'
      }
    ......
    output {
        elasticsearch {
          hosts => ["https://node1.elastic.com:9200"]
          index => "%{env}-xxx-%{indexDay}"
          cacert => '/usr/share/logstash/config/certs/ca.crt'
          # ssl_certificate_verification => false
          user => "elastic"
          password => "xxx"
        }
    }
  • logstash.yml
1
2
3
4
5
6
7
8
9
# 将 Logstash监控 数据传送到安全集群
node.name: logstash
path.config: /usr/share/logstash/pipeline/conf.d/*.conf
xpack.monitoring.enabled: true
xpack.monitoring.elasticsearch.username: logstash_system
xpack.monitoring.elasticsearch.password: xxx
xpack.monitoring.elasticsearch.hosts: ["https://node1.elastic.com:9200"]
xpack.monitoring.elasticsearch.ssl.certificate_authority: /usr/share/logstash/config/certs/ca.crt
#xpack.monitoring.elasticsearch.ssl.verification_mode: none
  • filebeat.yml

    将ca.crt复制到filebeat所在服务器

    1
    2
    3
    4
    5
    6
    # ------------------------------ Logstash Output -------------------------------
    output.logstash:
    # logstash服务ip
      hosts: ["经测试,这里写ip和dns都可"]
      ssl.certificate_authorities:
        - /etc/filebeat/ssl/ca.crt