elasticsearch如何安全加固？
elasticsearch2.4.6安全加固
安全歷來不是等到出事纔要注意的事情，能夠說安全是第一重要的事情。技術總監、運維總監、架構師仍是一線工程師，都應該有安全意識。
Elasticsearch 的用戶如今愈來愈多，有些更加已經成爲公司的基礎服務，因此數據的安全更爲重要。node
資源下載：http://down.51cto.com/data/2446746vim
1.基礎環境
1.1基礎環境說明
系統：CentOS7.3 Elasticsearch：2.4.6 192.168.2.142 主節點 192.168.2.144 節點
1.2安裝Elasticsearch
下載資源而後解壓安裝到/usr/share/elasticsearch瀏覽器
# cd /opt/ # unzip elasticsearch-2.4.6.zip Archive: elasticsearch-2.4.6.zip inflating: elasticsearch-2.4.6.rpm # rpm -ivh elasticsearch-2.4.6.rpm rpm -vih elasticsearch-2.4.6.rpm warning: elasticsearch-2.4.6.rpm: Header V4 RSA/SHA1 Signature, key ID d88e42b4: NOKEY Preparing... ################################# [100%] Creating elasticsearch group... OK Updating / installing... 1:elasticsearch-2.4.6-1 ################################# [100%] ### NOT starting on installation, please execute the following statements to configure elasticsearch service to start automatically using systemd sudo systemctl daemon-reload sudo systemctl enable elasticsearch.service ### You can start elasticsearch service by executing sudo systemctl start elasticsearch.service 目錄：/usr/share/elasticsearch
2.安裝安全插件
2.1安裝編譯插件
插件已經編譯安裝完成，直接解壓上傳便可緩存
# mkdir -p /usr/share/elasticsearch/config/ # cd /usr/share/elasticsearch/plugins # unzip plugins.zip #解壓後要刪除 # rm -rf plugins.zip #修改配置文件訪問 # vim /etc/elasticsearch/elasticsearch.yml network.host: 0.0.0.0 #保存退出
2.2基礎包安裝
#yum install -y gcc gcc+ zlib* #yum install openssl-devel
2.3安裝工具包
下載源碼包：http://down.51cto.com/6228054安全
# cd /usr/share/elasticsearch # unzip search-guard-ssl-2.4.6.zip
2.4修改默認配置
# cd /usr/share/elasticsearch/search-guard-ssl-2.4.6/example-pki-scripts/
修改vim example.sh
#!/bin/bash
set -e
./clean.sh
./gen_root_ca.sh elastic elastic
./gen_node_cert.sh 1 elastic elastic
./gen_node_cert.sh 2 elastic elastic
./gen_node_cert.sh 3 elastic elastic
./gen_client_node_cert.sh admin elastic elastic
#保存並退出
# chmod 777 *.sh
# sh example.sh
#參數說明：
./gen_root_ca.sh elastic elastic
第一個參數爲CA_PASS，即CA密碼（根證書密碼）
第二個參數爲TS_PASS，即TS密碼（truststore，信任證書密碼）
./gen_node_cert.sh 1 elastic elastic
第一個參數爲node編號，生成證書後的文件名爲node-1*
第二個參數爲KS_PASS（keystore文件密碼）
第三個參數爲CA_PASS
./gen_client_node_cert.sh admin elastic elastic
第一個參數爲客戶端節點名稱，生成證書後的文件名爲admin*
第二個參數爲KS_PASS
第三個參數爲CA_PASS
#有幾個節點就添加幾個./gen_node_cert.sh
sh example.sh
Generating a 2048 bit RSA private key
....................................................................+++
........................................+++
writing new private key to 'ca/root-ca/private/root-ca.key'
-----
Using configuration from etc/root-ca.conf
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
Not Before: May 8 02:20:51 2018 GMT
Not After : May 7 02:20:51 2028 GMT
Subject:
domainComponent = com
domainComponent = example
organizationName = Example Com Inc.
organizationalUnitName = Example Com Inc. Root CA
commonName = Example Com Inc. Root CA
X509v3 extensions:
X509v3 Key Usage: critical
Certificate Sign, CRL Sign
X509v3 Basic Constraints: critical
CA:TRUE
X509v3 Subject Key Identifier:
15:D5:36:15:B1:9C:CF:26:3B:58:E1:C0:F5:DA:41:58:45:A4:55:9A
X509v3 Authority Key Identifier:
keyid:15:D5:36:15:B1:9C:CF:26:3B:58:E1:C0:F5:DA:41:58:45:A4:55:9A
Certificate is to be certified until May 7 02:20:51 2028 GMT (3652 days)
Write out database with 1 new entries
Data Base Updated
Root CA generated
Generating a 2048 bit RSA private key
........................+++
.......+++
writing new private key to 'ca/signing-ca/private/signing-ca.key'
-----
Using configuration from etc/root-ca.conf
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 2 (0x2)
Validity
Not Before: May 8 02:20:51 2018 GMT
Not After : May 7 02:20:51 2028 GMT
Subject:
domainComponent = com
domainComponent = example
organizationName = Example Com Inc.
organizationalUnitName = Example Com Inc. Signing CA
commonName = Example Com Inc. Signing CA
X509v3 extensions:
X509v3 Key Usage: critical
Certificate Sign, CRL Sign
X509v3 Basic Constraints: critical
CA:TRUE, pathlen:0
X509v3 Subject Key Identifier:
9F:10:46:5C:96:22:76:FB:4A:97:E3:D2:03:D4:E5:6B:52:24:93:E1
X509v3 Authority Key Identifier:
keyid:15:D5:36:15:B1:9C:CF:26:3B:58:E1:C0:F5:DA:41:58:45:A4:55:9A
Certificate is to be certified until May 7 02:20:51 2028 GMT (3652 days)
Write out database with 1 new entries
Data Base Updated
Import back to keystore (including CA chain)
Certificate reply was installed in keystore
Entry for alias admin successfully imported.
Import command completed: 1 entries successfully imported, 0 entries failed or cancelled
MAC verified OK
MAC verified OK
MAC verified OK
All done for admin
2.5複製到config裏面
#cd /usr/share/elasticsearch/search-guard-ssl-2.4.6/example-pki-scripts #cp truststore.jks node-1-keystore.jks /usr/share/elasticsearch/config/ #cp truststore.jks admin-keystore.jks /usr/share/elasticsearch/plugins/search-guard-2/sgconfig/
3.修改權限
3.1修改配置文件及權限
#cd /usr/share/elasticsearch #chmod -R 777 ./plugins/search-guard-2/tools/sgadmin.sh #cd plugins/search-guard-2/ #chmod -R 777 tools/
3.2添加hash值
# cd /usr/share/elasticsearch/plugins/search-guard-2/tools # ./hash.sh -p vrv123456. $2a$12$GKyqoWHek3T505HTwIBPceIwZxROvDQnjEQSds1k2hT4D8rBZqdke # cd /usr/share/elasticsearch vim plugins/search-guard-2/sgconfig/sg_internal_users.yml 將字符串複製到sg_internal_users.yml文件的對應用戶密碼位置，在密碼下面記得寫入原密碼的提示，難保你那天忘記了。 elastic: hash: $2a$12$GKyqoWHek3T505HTwIBPceIwZxROvDQnjEQSds1k2hT4D8rBZqdke #password is: vrv123456.
3.3新建文件夾並賦予權限
# cd /usr/share/elasticsearch # mkdir -p data # mkdir -p logs # chmod 777 * logs # chmod 777 * data
3.4修改用戶權限
# vim /usr/share/elasticsearch/plugins/search-guard-2/sgconfig/sg_roles_mapping.yml
#添加用戶權限
sg_all_access:
users:
- admin
- adm
- elastic
3.5修改配置文件elasticsearch.yml
記得把源文件保存bash
# cd /usr/share/elasticsearch/config # vim elasticsearch.yml node.name: node-1 node.master: true # path.data: /usr/share/elasticsearch/data # # Path to log files: # path.logs: /usr/share/elasticsearch/logs #添加 #-------------------search guard config-------------------------- security.manager.enabled: false searchguard.authcz.admin_dn: -"CN=admin, OU=client, O=client, L=Test, C=DE" #-------------------search guard ssl---------------------------------------- #------------------------transport layer SSL------------------------------------ searchguard.ssl.transport.enabled: true searchguard.ssl.transport.keystore_filepath: node-1-keystore.jks searchguard.ssl.transport.keystore_password: elastic searchguard.ssl.transport.truststore_filepath: truststore.jks searchguard.ssl.transport.truststore_password: elastic searchguard.ssl.transport.enforce_hostname_verification: false searchguard.ssl.transport.resolve_hostname: false searchguard.ssl.http.enabled: true #設置成true瀏覽器也沒法訪問，測試請改成false searchguard.ssl.http.keystore_filepath: node-1-keystore.jks searchguard.ssl.http.keystore_password: elastic searchguard.ssl.http.truststore_filepath: truststore.jks searchguard.ssl.http.truststore_password: elastic searchguard.allow_all_from_loopback: true
4.驗證節點
4.1初始化安全
cd /usr/share/elasticsearch/ ./plugins/search-guard-2/tools/sgadmin.sh \ -cd plugins/search-guard-2/sgconfig/ \ -ks config/node-1-keystore.jks \ -ts config/truststore.jks \ -kspass elastic \ -tspass elastic \ -cn elasticsearch \ -h 192.168.2.142 \ -nhnv
4.2啓動elastic
# su - elasticsearch # cd /usr/share/elasticsearch/bin # ./elasticsearch -d
4.3驗證
http://192.168.2.142:9200/_plugin/kopf/#!/cluster服務器
輸入用戶名：elastic 密碼：vrv123456.架構
5.多節點驗證
5.1 複製elastic程序到別的機器上
進入142服務器 把程序複製上傳到144上 # cd /usr/share/ # scp -r elasticsearch/ root@192.168.2.144:/usr/share/
5.2複製文件到配置目錄裏
在144服務器上執行 # cd /usr/share/elasticsearch/search-guard-ssl-2.4.6/ # cd example-pki-scripts/ # chmod 777 * # cp -rf node-2-keystore.jks truststore.jks /usr/share/elasticsearch/config/ cp: overwrite ‘/usr/share/elasticsearch/config/truststore.jks’?
5.3賦予文件權限
# cd /usr/share/elasticsearch/config # chmod 777 *
5.4修改配置文件
# cd /usr/share/elasticsearch/config # vim elasticsearch.yml 修改內容 node.name: node-2 #節點 node.master: false searchguard.ssl.transport.keystore_filepath: node-2-keystore.jks #節點keystore文件，每一個節點都不同 searchguard.ssl.http.keystore_filepath: node-2-keystore.jks #其他文件不變 wq! 保存退出
5.5添加用戶
# useradd elasticsearch # cd /usr/share/elasticsearch/ # chown elasticsearch:elasticsearch plugins/
5.6刪除date緩存文件
# cd /usr/share/elasticsearch/ # rm -rf data/*
5.6啓動服務
# cd /usr/share/elasticsearch/bin # su elasticsearch $ ./elasticsearch -d
5.7驗證
http://192.168.2.142:9200/_plugin/kopf/#!/cluster
http://192.168.2.144:9200/_plugin/kopf/#!/cluster
輸入用戶名：elastic 密碼：vrv123456.app
6.安全加固
6.1 修改集羣默認名字
vim /usr/share/elasticsearch/config/elasticsearch.yml cluster.name: ceshi #集羣名字修改
6.2 禁用批量刪除
Elasticsearch 支持經過 _all（所有）和通配符（*）來批量刪除索引。 設置： action.destructive_requires_name: true 來禁用它。
6.3 不要以root身份去運行
# cd /usr/share/elasticsearch/bin # su elasticsearch $ ./elasticsearch -d
記住必定不要以 root 身份來運行 Elasticsearch。另外，不要和其餘的服務公用相同的用戶，而後還要把用戶的權限最小化。運維
6.4 開啓防火牆
#!/bin/bash yum install iptables-services systemctl enable iptables.service cat> /etc/sysconfig/iptables<<EOF # Firewall configuration written by system-config-firewall # Manual customization of this file is not recommended. *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 8080 -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 3306 -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 50070 -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 8088 -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 19888 -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 45454 -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 6188 -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 8042 -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 3000 -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 16010 -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 11000 -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 18080 -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 9200 -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 6188 -j ACCEPT -A INPUT -j REJECT --reject-with icmp-host-prohibited -A FORWARD -j REJECT --reject-with icmp-host-prohibited COMMIT EOF service iptables restart
7.總結
1.首先，請開啓防火牆，並設置防火牆規則爲只開啓必備的端口。完成以後，使用掃描工具掃描服務器，檢查端口開發狀況。
2.若是可能，不要用密碼的方法來遠程登陸服務器，儘量使用公私鑰的方式來 SSH 登陸服務器。若是隻能使用密碼，請妥善保管好你的用戶名和密碼，禁用 root 用戶，不用使用弱密碼。
3.關注 Java 最新的漏洞，使用安全的 JVM 運行。
4.注意服務器及時更新最新的軟件，使用安全的 repo 軟件源。綁定軟件源的 HOST 和 IP，避免 DNS 污染形成的，關注服務器軟件漏洞，及時打上補丁。
5.收集系統日誌和安裝相應的檢測軟件，及時發現服務器是否有異常行爲。
8.參考
http://www.elastic.co/cn/blog/reinforce-the-security-of-elasticsearch-101
9.後續預告
實戰到此結束。後續再更新knox安全配置實戰。
相關文章
- 1. sqlserver安全加固
- 2. apache安全加固
- 3. windows2003安全加固
- 4. Windows2003安全加固
- 5. tomcat安全加固
- 6. Jboss安全加固
- 7. linux 安全加固
- 8. LAMP安全加固
- 9. Linux 安全加固
- 10. IIS7安全加固
- 更多相關文章...
- • XSD 如何使用? - XML Schema 教程
- • ASP.NET MVC - 安全 - ASP.NET 教程
- • Composer 安裝與使用
- • Tomcat學習筆記（史上最全tomcat學習筆記）
相關標籤/搜索
每日一句
-
每一个你不满意的现在，都有一个你没有努力的曾经。
最新文章
- 1. eclipse設置粘貼字符串自動轉義
- 2. android客戶端學習-啓動模擬器異常Emulator: failed to initialize HAX: Invalid argument
- 3. android.view.InflateException: class com.jpardogo.listbuddies.lib.views.ListBuddiesLayout問題
- 4. MYSQL8.0數據庫恢復 MYSQL8.0ibd數據恢復 MYSQL8.0恢復數據庫
- 5. 你本是一個肉體，是什麼驅使你前行【1】
- 6. 2018.04.30
- 7. 2018.04.30
- 8. 你本是一個肉體，是什麼驅使你前行【3】
- 9. 你本是一個肉體，是什麼驅使你前行【2】
- 10. 【資訊】LocalBitcoins達到每週交易比特幣的7年低點
歡迎關注本站公眾號,獲取更多信息
相關文章
- 1. sqlserver安全加固
- 2. apache安全加固
- 3. windows2003安全加固
- 4. Windows2003安全加固
- 5. tomcat安全加固
- 6. Jboss安全加固
- 7. linux 安全加固
- 8. LAMP安全加固
- 9. Linux 安全加固
- 10. IIS7安全加固