kibana权限管理——SearchGuard

安装

首先根据es版本来选择search-guard,当前环境为5.4.1,因此选择对应版本。其他5.x参考 https://docs.search-guard.com/v5/search-guard-versions

https://docs.search-guard.com/v5/search-guard-installation

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
[joy@es_a2_1_19 elasticsearch]$ bin/elasticsearch-plugin install -b  com.floragunn:search-guard-5:5.4.1-15
-> Downloading com.floragunn:search-guard-5:5.4.1-15 from maven central
[=================================================] 100%
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: plugin requires additional permissions @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
* java.io.FilePermission /proc/sys/net/core/somaxconn read
* java.lang.RuntimePermission accessClassInPackage.sun.misc
* java.lang.RuntimePermission accessClassInPackage.sun.nio.ch
* java.lang.RuntimePermission accessClassInPackage.sun.security.x509
* java.lang.RuntimePermission accessDeclaredMembers
* java.lang.RuntimePermission getClassLoader
* java.lang.RuntimePermission loadLibrary.*
* java.lang.RuntimePermission setContextClassLoader
* java.lang.RuntimePermission shutdownHooks
* java.lang.reflect.ReflectPermission suppressAccessChecks
* java.security.SecurityPermission getProperty.ssl.KeyManagerFactory.algorithm
* java.security.SecurityPermission setProperty.ocsp.enable
* java.util.PropertyPermission com.sun.security.enableCRLDP write
* java.util.PropertyPermission es.set.netty.runtime.available.processors write
* java.util.PropertyPermission java.security.debug write
* java.util.PropertyPermission java.security.krb5.conf write
* java.util.PropertyPermission javax.security.auth.useSubjectCredsOnly write
* java.util.PropertyPermission sun.nio.ch.bugLevel write
* java.util.PropertyPermission sun.security.krb5.debug write
* java.util.PropertyPermission sun.security.spnego.debug write
* javax.security.auth.AuthPermission doAs
* javax.security.auth.AuthPermission modifyPrivateCredentials
* javax.security.auth.kerberos.ServicePermission * accept
See http://docs.oracle.com/javase/8/docs/technotes/guides/security/permissions.html
for descriptions of what these permissions allow and the associated risks.
-> Installed search-guard-5

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
[joy@es_a2_1_19 tools]$ sh install_demo_configuration.sh
## Search Guard Demo Installer ##
Warning: Do not use on production or public reachable systems
Continue? [y/N] y
Elasticsearch install type: .tar.gz
Elasticsearch config dir: /home/joy/elasticsearch/config
Detected Elasticsearch Version: 5.4.1
Detected Search Guard Version: 5.4.1-15

### Success
### Execute this script now on all your nodes and then start all nodes
### After the whole cluster is up execute:
/home/joy/elasticsearch/plugins/search-guard-5/tools/sgadmin.sh -cd /home/joy/elasticsearch/plugins/search-guard-5/sgconfig -cn searchguard_demo -ks /home/joy/elasticsearch/config/kirk.jks -ts /home/joy/elasticsearch/config/truststore.jks -nhnv
### or run ./sgadmin_demo.sh
### Then open https://localhost:9200 an login with admin/admin
### (Just ignore the ssl certificate warning because we installed a self signed demo certificate)

elasticsearch.yml将会自动增加下列内容

1
2
3
4
5
6
7
8
9
10
11
12
13
######## Start Search Guard Demo Configuration ########
searchguard.ssl.transport.keystore_filepath: keystore.jks
searchguard.ssl.transport.truststore_filepath: truststore.jks
searchguard.ssl.transport.enforce_hostname_verification: false
searchguard.ssl.http.enabled: true
searchguard.ssl.http.keystore_filepath: keystore.jks
searchguard.ssl.http.truststore_filepath: truststore.jks
searchguard.authcz.admin_dn:
- CN=kirk,OU=client,O=client,L=test, C=de

cluster.name: searchguard_demo
network.host: 0.0.0.0
######## End Search Guard Demo Configuration ########

但是最终还是失败了,以后再看

https://my.oschina.net/huangweibin/blog/820858
https://www.cnblogs.com/marility/p/9392645.html
http://xiaoqiangge.com/aritcle/1536058241842.html
https://blog.csdn.net/sinat_39562444/article/details/88235809

参考资料

https://github.com/floragunncom/search-guard

------ 本文结束 ------

版权声明

Medivh's Notes by Medivh is licensed under a Creative Commons BY-NC-ND 4.0 International License.
Medivh创作并维护的Medivh's Notes博客采用创作共用保留署名-非商业-禁止演绎4.0国际许可证
本文首发于Medivh 博客( http://www.mknight.cn ),版权所有,侵权必究。