elasticsearch-tls
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| elasticsearch-tls [2020/11/07 11:45] – baumi | elasticsearch-tls [2020/11/08 12:41] (current) – baumi | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| ====== Configure Elasticsearch/ | ====== Configure Elasticsearch/ | ||
| + | ===== Create Certificates ===== | ||
| - Shutdown elk-cluster | - Shutdown elk-cluster | ||
| - | - Add certificate path to elasticsearch config in docker-compose.yml | + | - Add certificate path to elasticsearch config in docker-compose.yml< |
| - | | + | services: |
| - | volumes: | + | elasticsearch: |
| - | - ./ | + | |
| - | </ | + | - ./ |
| - | - Start elasticsearch | + | </ |
| - | | + | - Start elasticsearch< |
| - | + | - Create certificates< | |
| - | - Create certificates | + | |
| - | < | + | |
| $ docker exec -it elk-test-elasticsearch bash | $ docker exec -it elk-test-elasticsearch bash | ||
| + | |||
| [root@elk-test-elasticsearch elasticsearch]# | [root@elk-test-elasticsearch elasticsearch]# | ||
| This tool assists you in the generation of X.509 certificates and certificate | This tool assists you in the generation of X.509 certificates and certificate | ||
| Line 24: | Line 23: | ||
| Please enter the desired output file [elastic-stack-ca.zip]: | Please enter the desired output file [elastic-stack-ca.zip]: | ||
| [root@elk-test-elasticsearch elasticsearch]# | [root@elk-test-elasticsearch elasticsearch]# | ||
| + | Archive: | ||
| + | | ||
| + | inflating: / | ||
| + | inflating: / | ||
| [root@elk-test-elasticsearch elasticsearch]# | [root@elk-test-elasticsearch elasticsearch]# | ||
| Line 54: | Line 57: | ||
| CA Key: / | CA Key: / | ||
| - | |||
| - | ## How long should your certificates be valid? | ||
| - | |||
| - | [ ... ] | ||
| For how long should your certificate be valid? [5y] | For how long should your certificate be valid? [5y] | ||
| Line 146: | Line 145: | ||
| inflating: / | inflating: / | ||
| </ | </ | ||
| - | + | ===== Configure elasticsearch for TLS & X-Pack Security ===== | |
| + | |||
| + | - Shutdown elasticsearch< | ||
| + | $ docker-compose down | ||
| + | Stopping elk-test-elasticsearch ... done | ||
| + | Removing elk-test-elasticsearch ... done | ||
| + | Removing network elk-test_default | ||
| + | </ | ||
| + | - Add certificate mount to docker-compose< | ||
| + | volumes: | ||
| + | - ./ | ||
| + | </ | ||
| + | - Copy P12 file to correct place< | ||
| + | $ cp certs/ | ||
| + | $ sudo chown 1000:1000 elasticsearch/ | ||
| + | $ sudo chmod 600 elasticsearch/ | ||
| + | </ | ||
| + | - Update elasticsearch.yml< | ||
| + | $ grep xpack elasticsearch/ | ||
| + | xpack.security.enabled: | ||
| + | xpack.security.http.ssl.enabled: | ||
| + | xpack.security.http.ssl.verification_mode: | ||
| + | xpack.security.http.ssl.keystore.path: | ||
| + | </ | ||
| + | - Start elasticsearch< | ||
| + | docker-compose up -d elasticsearch | ||
| + | Creating network " | ||
| + | Creating elk-test-elasticsearch ... done | ||
| + | </ | ||
| + | - Create Users< | ||
| + | $ docker exec -it elk-test-elasticsearch bash | ||
| + | [root@elk-test-elasticsearch elasticsearch]# | ||
| + | Initiating the setup of passwords for reserved users elastic, | ||
| + | The passwords will be randomly generated and printed to the console. | ||
| + | Please confirm that you would like to continue [y/N]y | ||
| + | |||
| + | |||
| + | Changed password for user apm_system | ||
| + | PASSWORD apm_system = *** | ||
| + | |||
| + | Changed password for user kibana_system | ||
| + | PASSWORD kibana_system = *** | ||
| + | |||
| + | Changed password for user kibana | ||
| + | PASSWORD kibana = *** | ||
| + | |||
| + | Changed password for user logstash_system | ||
| + | PASSWORD logstash_system = *** | ||
| + | |||
| + | Changed password for user beats_system | ||
| + | PASSWORD beats_system = *** | ||
| + | |||
| + | Changed password for user remote_monitoring_user | ||
| + | PASSWORD remote_monitoring_user = *** | ||
| + | |||
| + | Changed password for user elastic | ||
| + | PASSWORD elastic = *** | ||
| + | </ | ||
| + | ===== Configure Kibana for TLS and User Authentication ===== | ||
| + | - Copy CA file to correct path< | ||
| + | $ cp certs/ | ||
| + | - Add CA file mount do docker-compose.yml< | ||
| + | services: | ||
| + | kibana: | ||
| + | volumes: | ||
| + | - ./ | ||
| + | </ | ||
| + | - Add TLS & authentication information to kibana.yml< | ||
| + | elasticsearch: | ||
| + | hosts: [ " | ||
| + | ssl.certificateAuthorities: | ||
| + | username: " | ||
| + | password: " | ||
| + | </ | ||
| + | - Restart elk-stack< | ||
| + | $ docker-compose up -d && docker-compose logs -f | ||
| + | </ | ||
| + | |||
| + | ===== Move username & password from Kibana Config ===== | ||
| + | |||
| + | - Create Keystore and populate with logon information< | ||
| + | $ docker exec -it elk-test-kibana bash | ||
| + | bash-4.2$ bin/ | ||
| + | Created Kibana keystore in / | ||
| + | bash-4.2$ bin/ | ||
| + | Enter value for elasticsearch.username: | ||
| + | bash-4.2$ bin/ | ||
| + | Enter value for elasticsearch.password: | ||
| + | </ | ||
| + | - Copy keystore to persistent storage< | ||
| + | $ docker cp elk-test-kibana:/ | ||
| + | </ | ||
| + | - Adjust docker-compose.yml for bind mount of keystore file< | ||
| + | services: | ||
| + | kibana: | ||
| + | volumes: | ||
| + | - ./ | ||
| + | </ | ||
| + | - Remove elasticsearch.username and elasticsearch.username from kibana.yml | ||
| + | - Restart kibana | ||
| + | |||
| + | |||
| + | |||
| + | {{tag>kb elasticsearch}} | ||
elasticsearch-tls.1604745957.txt.gz · Last modified: 2020/11/07 11:45 by baumi