安装Search Guard

和其他的elastic插件安装方式相同，使用elasticsearch-plugin安装search guard

在线安装

需要将<version>替换为和当前es环境匹配的版本

bin/elasticsearch-plugin install -b com.floragunn:search-guard-6:<version>

例如：

bin/elasticsearch-plugin install -b com.floragunn:search-guard-6:6.6.2-24.2

具体版本号见查询地址：search-guard-versions

离线安装

从search-guard-versions下载安装包，使用如下命令：

[@djt_46_221 elasticsearch-6.6.1]# ./bin/elasticsearch-plugin install -b file:///search/odin/app/search-guard-6-6.6.1-24.2.zip
-> Downloading file:///search/odin/app/search-guard-6-6.6.1-24.2.zip
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@     WARNING: plugin requires additional permissions     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
* java.io.FilePermission /proc/sys/net/core/somaxconn read
* java.lang.RuntimePermission accessClassInPackage.com.sun.jndi.ldap
...
* javax.security.auth.AuthPermission modifyPrivateCredentials
* javax.security.auth.kerberos.ServicePermission * accept
See http://docs.oracle.com/javase/8/docs/technotes/guides/security/permissions.html
for descriptions of what these permissions allow and the associated risks.
-> Installed search-guard-6

修改elasticsearch.yml配置

这个地方用到了证书，有几种生成证书的方式，可以在线生成tls-certificate-generator，也可以使用Search Guard TLS Tool，测试环境使用在线的方式比较简单，将生成的压缩包下载即可

在elasticsearch.yml增加如下配置，配置内容参照readme.txt，用节点主机名替换 [hostname]部分 私钥和密码替换 [key password for this node]

searchguard.ssl.transport.pemcert_filepath: CN=[hostname].crtfull.pem
searchguard.ssl.transport.pemkey_filepath: CN=[hostname].key.pem
searchguard.ssl.transport.pemkey_password: [private key password for this node]
searchguard.ssl.transport.pemtrustedcas_filepath: chain-ca.pem
searchguard.ssl.transport.enforce_hostname_verification: false
searchguard.ssl.http.enabled: true
searchguard.ssl.http.pemcert_filepath: CN=[hostname].crtfull.pem
searchguard.ssl.http.pemkey_filepath: CN=[hostname].key.pem
searchguard.ssl.http.pemkey_password: [private key password for this node]
searchguard.ssl.http.pemtrustedcas_filepath: chain-ca.pem
                                                             
searchguard.authcz.admin_dn:                                
  - CN=sgadmin  
  

######## Start Search Guard Configuration ########
searchguard.ssl.transport.pemcert_filepath: key/node-certificates/CN=IP-10.138.46.221.crtfull.pem
searchguard.ssl.transport.pemkey_filepath: key/node-certificates/CN=IP-10.138.46.221.key.pem
searchguard.ssl.transport.pemkey_password: 212be8d21c4403816e67
searchguard.ssl.transport.pemtrustedcas_filepath: key/chain-ca.pem
searchguard.ssl.transport.enforce_hostname_verification: false
searchguard.ssl.http.enabled: true
searchguard.ssl.http.pemcert_filepath: key/node-certificates/CN=IP-10.138.46.221.crtfull.pem
searchguard.ssl.http.pemkey_filepath: key/node-certificates/CN=IP-10.138.46.221.key.pem
searchguard.ssl.http.pemkey_password: 212be8d21c4403816e67
searchguard.ssl.http.pemtrustedcas_filepath: key/chain-ca.pem

searchguard.authcz.admin_dn:
  - CN=sgadmin

searchguard.audit.type: internal_elasticsearch
searchguard.enable_snapshot_restore_privilege: true
searchguard.check_snapshot_restore_write_privileges: true
searchguard.restapi.roles_enabled: ["sg_all_access"]
cluster.routing.allocation.disk.threshold_enabled: false
discovery.zen.minimum_master_nodes: 1
node.max_local_storage_nodes: 3
xpack.security.enabled: false

######## End Search Guard Configuration ########

完成后启动elasticsearch

sgadmin

如果要执行sgadmin命令的话，需要将证书生成压缩包中的以下文件

• root-ca.pem
• client-certificates/CN=sgadmin.crtfull.pem
• client-certificates/CN=sgadmin.key.pem
  拷贝到
  plugins/search-guard-<version>/tools

切换到plugins/search-guard-<version>/tools目录

chmod 755 ./sgadmin.sh
./sgadmin.sh -cacert root-ca.pem -cert CN=sgadmin.crtfull.pem -key CN=sgadmin.key.pem -keypass b0ecfa16c57aa1cdf646 -nhnv -icl -cd ../sgconfig/

显示如下内容

[@djt_46_221 tools]# ./sgadmin.sh -cacert root-ca.pem -cert CN=sgadmin.crtfull.pem -key CN=sgadmin.key.pem -keypass b0ecfa16c57aa1cdf646 -nhnv -icl -cd ../sgconfig/
Search Guard Admin v6
Will connect to localhost:9300 ... done
Elasticsearch Version: 6.6.1
Search Guard Version: 6.6.1-24.2
Connected as CN=sgadmin
Contacting elasticsearch cluster 'elasticsearch' and wait for YELLOW clusterstate ...
Clustername: pingz
Clusterstate: YELLOW
Number of nodes: 1
Number of data nodes: 1
searchguard index already exists, so we do not need to create one.
Populate config from /search/odin/app/elasticsearch-6.6.1/plugins/search-guard-6/sgconfig
Will update 'sg/config' with ../sgconfig/sg_config.yml 
   SUCC: Configuration for 'config' created or updated
Will update 'sg/roles' with ../sgconfig/sg_roles.yml 
   SUCC: Configuration for 'roles' created or updated
Will update 'sg/rolesmapping' with ../sgconfig/sg_roles_mapping.yml 
   SUCC: Configuration for 'rolesmapping' created or updated
Will update 'sg/internalusers' with ../sgconfig/sg_internal_users.yml 
   SUCC: Configuration for 'internalusers' created or updated
Will update 'sg/actiongroups' with ../sgconfig/sg_action_groups.yml 
   SUCC: Configuration for 'actiongroups' created or updated
Done with success