Elasticsearch 8集群搭建、安全功能配置详述

$ wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-8.4.3-linux-x86_64.tar.gz
$ wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-8.4.3-linux-x86_64.tar.gz.sha512
$ shasum -a 512 -c elasticsearch-8.4.3-linux-x86_64.tar.gz.sha512
elasticsearch-8.4.3-linux-x86_64.tar.gz: OK

$ curl -O https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-8.4.3-darwin-x86_64.tar.gz
$ curl https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-8.4.3-darwin-x86_64.tar.gz.sha512 | shasum -a 512 -c -

$ yum install perl-Digest-SHA

$ tar -xzf elasticsearch-8.4.3-linux-x86_64.tar.gz
$ cd elasticsearch-8.4.3/
$ pwd
home/elastic/elasticsearch-8.4.3

ES_HOME=home/elastic/elasticsearch-8.4.3

$ echo $ES_HOME
/home/elastic/elasticsearch-8.4.3

action.auto_create_index: .monitoring*,.watches,.triggered_watches,.watcher-history*,.ml*

* soft nofile 65536
* hard nofile 131072
* soft nproc 4096
* hard nproc 4096

vm.max_map_count=262144

$ ./bin/elasticsearch
warning: ignoring JAVA_HOME=/opt/jdk-17.0.5; using bundled JDK
[2022-12-14T14:30:09,021][INFO ][o.e.n.Node               ] [node1] version[8.4.3], pid[2073], build[tar/42f05b9372a9a4a470db3b52817899b99a76ee73/2022-10-04T07:17:24.662462378Z], OS[Linux/3.10.0-1160.76.1.el7.x86_64/amd64], JVM[Oracle Corporation/OpenJDK 64-Bit Server VM/18.0.2.1/18.0.2.1+1-1]
[2022-12-14T14:30:09,038][INFO ][o.e.n.Node               ] [node1] JVM home [/home/elastic/elasticsearch-8.4.3/jdk], using bundled JDK [true]
......

[2022-12-14T14:30:42,065][INFO ][o.e.c.m.MetadataCreateIndexService] [node1] [.geoip_databases] creating index, cause [auto(bulk api)], templates [], shards [1]/[0]
[2022-12-14T14:30:42,463][INFO ][o.e.c.r.a.AllocationService] [node1] current.health="GREEN" message="Cluster health status changed from [YELLOW] to [GREEN] (reason: [shards started [[.geoip_databases][0]]])." previous.health="YELLOW" reason="shards started [[.geoip_databases][0]]"
[2022-12-14T14:30:43,929][INFO ][o.e.i.g.GeoIpDownloader  ] [node1] successfully downloaded geoip database [GeoLite2-ASN.mmdb]
[2022-12-14T14:30:44,355][INFO ][o.e.i.g.DatabaseNodeService] [node1] successfully loaded geoip database file [GeoLite2-ASN.mmdb]
[2022-12-14T14:30:45,144][INFO ][o.e.x.s.InitialNodeSecurityAutoConfiguration] [node1] HTTPS has been configured with automatically generated certificates, and the CA's hex-encoded SHA-256 fingerprint is [8a717506cb9c1f7c8190a6c3a2026cead47790aca632e35e988a65fdda78366d]
[2022-12-14T14:30:45,152][INFO ][o.e.x.s.s.SecurityIndexManager] [node1] security index does not exist, creating [.security-7] with alias [.security]
[2022-12-14T14:30:45,196][INFO ][o.e.x.s.e.InternalEnrollmentTokenGenerator] [node1] Will not generate node enrollment token because node is only bound on localhost for transport and cannot connect to nodes from other hosts
[2022-12-14T14:30:45,325][INFO ][o.e.c.m.MetadataCreateIndexService] [node1] [.security-7] creating index, cause [api], templates [], shards [1]/[0]
[2022-12-14T14:30:45,386][INFO ][o.e.x.s.s.SecurityIndexManager] [node1] security index does not exist, creating [.security-7] with alias [.security]
[2022-12-14T14:30:45,521][INFO ][o.e.c.r.a.AllocationService] [node1] current.health="GREEN" message="Cluster health status changed from [YELLOW] to [GREEN] (reason: [shards started [[.security-7][0]]])." previous.health="YELLOW" reason="shards started [[.security-7][0]]"

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
✅ Elasticsearch security features have been automatically configured!
✅ Authentication is enabled and cluster connections are encrypted.

ℹ️  Password for the elastic user (reset with `bin/elasticsearch-reset-password -u elastic`):
  LYePogNEis=ogbMaUzmJ

ℹ️  HTTP CA certificate SHA-256 fingerprint:
  8a717506cb9c1f7c8190a6c3a2026cead47790aca632e35e988a65fdda78366d

ℹ️  Configure Kibana to use this cluster:
• Run Kibana and click the configuration link in the terminal when Kibana starts.
• Copy the following enrollment token and paste it into Kibana in your browser (valid for the next 30 minutes):
  eyJ2ZXIiOiI4LjQuMyIsImFkciI6WyIxOTIuMTY4LjU2LjExOjkyMDAiXSwiZmdyIjoiOGE3MTc1MDZjYjljMWY3YzgxOTBhNmMzYTIwMjZjZWFkNDc3OTBhY2E2MzJlMzVlOTg4YTY1ZmRkYTc4MzY2ZCIsImtleSI6Im9aNVVENFVCbFJ4a2VsQU9EbXZxOlpvYXBVWjBUVERTdjk5aDNRV25oNUEifQ==

ℹ️  Configure other nodes to join this cluster:
• On this node:
  ⁃ Create an enrollment token with `bin/elasticsearch-create-enrollment-token -s node`.
  ⁃ Uncomment the transport.host setting at the end of config/elasticsearch.yml.
  ⁃ Restart Elasticsearch.
• On other nodes:
  ⁃ Start Elasticsearch with `bin/elasticsearch --enrollment-token <token>`, using the enrollment token that you generated.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

[2022-12-14T14:30:57,162][INFO ][o.e.i.g.GeoIpDownloader  ] [node1] successfully downloaded geoip database [GeoLite2-City.mmdb]
[2022-12-14T14:30:58,768][INFO ][o.e.i.g.GeoIpDownloader  ] [node1] successfully downloaded geoip database [GeoLite2-Country.mmdb]
[2022-12-14T14:30:58,815][INFO ][o.e.i.g.DatabaseNodeService] [node1] successfully loaded geoip database file [GeoLite2-City.mmdb]
[2022-12-14T14:30:58,898][INFO ][o.e.i.g.DatabaseNodeService] [node1] successfully loaded geoip database file [GeoLite2-Country.mmdb]

curl --cacert $ES_HOME/config/certs/http_ca.crt -u elastic https://localhost:9200 

[elastic@node1 ~]$ curl --cacert ~/elasticsearch-8.4.3/config/certs/http_ca.crt -u elastic https://localhost:9200
Enter host password for user 'elastic':
{
  "name" : "node1",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "-oF_yhG7TtamNIARhI4-Tg",
  "version" : {
    "number" : "8.4.3",
    "build_flavor" : "default",
    "build_type" : "tar",
    "build_hash" : "42f05b9372a9a4a470db3b52817899b99a76ee73",
    "build_date" : "2022-10-04T07:17:24.662462378Z",
    "build_snapshot" : false,
    "lucene_version" : "9.3.0",
    "minimum_wire_compatibility_version" : "7.17.0",
    "minimum_index_compatibility_version" : "7.0.0"
  },
  "tagline" : "You Know, for Search"
}

bin/elasticsearch-create-enrollment-token -s node

bin/elasticsearch --enrollment-token <enrollment-token>

[elastic@node1 elasticsearch-8.4.3]$ bin/elasticsearch-create-enrollment-token -s node
warning: ignoring JAVA_HOME=/opt/jdk-17.0.5; using bundled JDK
eyJ2ZXIiOiI4LjQuMyIsImFkciI6WyIxOTIuMTY4LjU2LjExOjkyMDAiXSwiZmdyIjoiOGE3MTc1MDZjYjljMWY3YzgxOTBhNmMzYTIwMjZjZWFkNDc3OTBhY2E2MzJlMzVlOTg4YTY1ZmRkYTc4MzY2ZCIsImtleSI6IjJQdVRESVlCWU1kQnBSaTdnODVQOlRfa1RDR3BlVDJPdTZvMzBzanBPRVEifQ==

[elastic@node2 elasticsearch-8.4.3]$ bin/elasticsearch --enrollment-token eyJ2ZXIiOiI4LjQuMyIsImFkciI6WyIxOTIuMTY4LjU2LjExOjkyMDAiXSwiZmdyIjoiOGE3MTc1MDZjYjljMWY3YzgxOTBhNmMzYTIwMjZjZWFkNDc3OTBhY2E2MzJlMzVlOTg4YTY1ZmRkYTc4MzY2ZCIsImtleSI6IjJQdVRESVlCWU1kQnBSaTdnODVQOlRfa1RDR3BlVDJPdTZvMzBzanBPRVEifQ==

[2023-02-01T18:46:59,135][WARN ][o.e.c.c.ClusterFormationFailureHelper] [node2] master not discovered yet, this node has not previously joined a bootstrapped cluster, and [cluster.initial_master_nodes] is empty on this node: have discovered [{node2}{kuM1xg2lR4myQH6N-AsxGA}{2cS3Wrm1RDKLxMyFgo_NYQ}{node2}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}]; discovery will continue using [] from hosts providers and [{node2}{kuM1xg2lR4myQH6N-AsxGA}{2cS3Wrm1RDKLxMyFgo_NYQ}{node2}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}] from last-known cluster state; node term 0, last-accepted version 0 in term 0

ERROR: Skipping security auto configuration because it appears that the node is not starting up for the first time. The node might already be part of a cluster and this auto setup utility is designed to configure Security for new clusters only.

ERROR: Aborting enrolling to cluster. Could not communicate with the node on any                                                                      of the addresses from the enrollment token. All of [192.168.56.11:9200] were at                                                                     tempted.

[elastic@node2 elasticsearch-8.4.3]$ bin/elasticsearch --enrollment-token eyJ2ZXIiOiI4LjQuMyIsImFkciI6WyIxOTIuMTY4LjU2LjExOjkyMDAiXSwiZmdyIjoiOGE3MTc1MDZjYjljMWY3YzgxOTBhNmMzYTIwMjZjZWFkNDc3OTBhY2E2MzJlMzVlOTg4YTY1ZmRkYTc4MzY2ZCIsImtleSI6IlBHUGNESVlCdkt6dldhTUF2SVF0Ok9kRzgzQS1YUVUtOGkwdVRrSnZpZWcifQ==
[2023-02-01T20:04:29,861][INFO ][o.e.n.Node               ] [node2] version[8.4.3], pid[1675], build[tar/42f05b9372a9a4a470db3b52817899b99a76ee73/2022-10-
[2023-02-01T20:04:58,053][INFO ][o.e.c.s.ClusterApplierService] [node2] master node changed {previous [], current [{node1}{Ugh2e7ubSb2fw9Wj8U918A}{l_xB6z5QQee23U2jX8Ctiw}{node1}{192.168.56.11}{192.168.56.11:9300}{cdfhilmrstw}]}, added {{node1}{Ugh2e7ubSb2fw9Wj8U918A}{l_xB6z5QQee23U2jX8Ctiw}{node1}{192.168.56.11}{192.168.56.11:9300}{cdfhilmrstw}}, term: 7, version: 93, reason: ApplyCommitRequest{term=7, version=93, sourceNode={node1}{Ugh2e7ubSb2fw9Wj8U918A}{l_xB6z5QQee23U2jX8Ctiw}{node1}{192.168.56.11}{192.168.56.11:9300}{cdfhilmrstw}{ml.machine_memory=1907675136, ml.max_jvm_size=956301312, xpack.installed=true, ml.allocated_processors=1}}
......
......
[2023-02-01T20:04:58,299][INFO ][o.e.n.Node               ] [node2] started {node2}{TplD7Q2DT_K1tZaxhL6PjA}{xgNgZioKTFWFu8jBKOmZJQ}{node2}{192.168.56.12}{192.168.56.12:9300}{cdfhilmrstw}{xpack.installed=true, ml.allocated_processors=1, ml.max_jvm_size=956301312, ml.machine_memory=1907675136}

curl --cacert $ES_HOME/config/certs/http_ca.crt -u elastic https://192.168.56.11:9200/_cat/nodes?v

ip            heap.percent ram.percent cpu load_1m load_5m load_15m node.role   master name
192.168.56.11           32          91   0    0.01    0.07     0.12 cdfhilmrstw *      node1
192.168.56.12           40          96   0    0.00    0.08     0.10 cdfhilmrstw -      node2

./bin/elasticsearch -d -p pid

pkill -F pid

./bin/elasticsearch -d -Ecluster.name=my_cluster -Enode.name=node_1

openssl x509 -fingerprint -sha256 -in config/certs/http_ca.crt

SHA256 Fingerprint=8A:71:75:06:CB:9C:1F:7C:81:90:A6:C3:A2:02:6C:EA:D4:77:90:AC:A6:32:E3:5E:98:8A:65:FD:DA:78:36:6D

ℹ️  HTTP CA certificate SHA-256 fingerprint:
  8a717506cb9c1f7c8190a6c3a2026cead47790aca632e35e988a65fdda78366d

issuer= /CN=Elasticsearch security auto-configuration HTTP CA