https://www.elastic.co/guide/en/shield/shield-1.3/introduction.html
一、简介
Shield是Elasticsearch的一个插件，它能够很容易的保证你的Elasticsearch集群的安全性。
Shield的功能：
1.用户认证
2.SSL/TLS的加密身份验证
3.审计
二、安装
我使用的shield-1.3的版本
- 安装Elasticsearch集群
- Shield是需要licese的，我们只有在offline机器上安装使用
a.下载license https://download.elastic.co/elasticsearch/license/license-latest.zip
[[email protected] usr]# pwd
/usr
[[email protected] usr]# wget https://download.elastic.co/elasticsearch/license/license-latest.zip
...
...b. 下载 shield https://download.elastic.co/elasticsearch/shield/shield-latest.zip
[[email protected] usr]# pwd
/usr
[[email protected] usr]# wget https://download.elastic.co/elasticsearch/shield/shield-latest.zip
...
...c. 安装license 和 shield
注意/usr/share/elasticsearch/ 是elasticsearch的安装目录
是本地文件的协议前缀
[[email protected] usr]# /usr/share/elasticsearch/bin/plugin -i license -u file:///usr/license-latest.zip
...
...
[[email protected] usr]# /usr/share/elasticsearch/bin/plugin -i license -u file:///usr/shield-latest.zip
...
...
校验：
[[email protected] usr]# ll /usr/share/elasticsearch/plugins/
...
...
license
shield
...
[[email protected] usr]# curl -XGET ‘ => 此时是无法访问的，需要身份验证
...
首先创建一个管理员
[[email protected] plugins]# /usr/share/elasticsearch/bin/shield/esusers useradd es_admin -r admin
...
[[email protected] usr]# curl -XGET -u es_admin:{passwd} ‘http://{ip}:9200/‘三、消息认证(enable message authentication)
https://www.elastic.co/guide/en/shield/shield-1.3/enable-message-authentication.html
消息验证会验证消息传输过程中是否被篡改等
1.生成key
[[email protected] shield]# /usr/share/elasticsearch/bin/shield/syskeygen
...
会生成 ES_HOME/config/shield/system_key
然后再elasticsearch.yml 中配置
shield.system_key.file=
2.复制key到其他各个节点上，各个节点必须相同四、用户认证配置(setting up user authentication)
为了获取受限资源权限，用户必须提供身份校验信息。如密码等。
1.esusers
是shield内置一种方式
https://www.elastic.co/guide/en/shield/shield-1.3/esusers.html
https://www.elastic.co/guide/en/shield/shield-1.3/_managing_users_in_an_esusers_realm.html
添加用户(Adding User)
[[email protected] plugins]# /usr/share/elasticsearch/bin/shield/esusers useradd test_1
会提示让你输入密码，
[[email protected] plugins]# /usr/share/elasticsearch/bin/shield/esusers useradd test-1 -p test_1
这样就会创建一个用户test_1 密码是 test_1
[[email protected] plugins]# /usr/share/elasticsearch/bin/shield/esusers list
#【userid】: 【roleid】
...
test_1 : -
...
默认角色是 - 也没有啥权限，稍后会说明角色与权限
修改用户密码(Managing User Passwords)
[[email protected] plugins]# /usr/share/elasticsearch/bin/shield/esusers passwd test-1 -p test_12. 基于角色的访问控制
https://www.elastic.co/guide/en/shield/shield-1.3/configuring-rbac.html
定义角色(Defining Roles)
roles.yml
[[email protected] shield]# pwd
/etc/elasticsearch/shield
[[email protected] shield]# ll
total 36
-rwxr-xr-x 1 elasticsearch elasticsearch 1119 Nov 9 05:21 logging.yml
-rw------- 1 elasticsearch elasticsearch 1119 Nov 9 06:28 logging.yml.new
-rwxr-xr-x 1 elasticsearch elasticsearch 473 Nov 9 05:21 role_mapping.yml
-rw------- 1 elasticsearch elasticsearch 473 Nov 9 06:28 role_mapping.yml.new
-rwxr-xr-x 1 elasticsearch elasticsearch 2634 Nov 12 09:06 roles.yml => 角色与权限的映射
-rw------- 1 elasticsearch elasticsearch 2699 Nov 9 06:28 roles.yml.new
-rw------- 1 elasticsearch elasticsearch 128 Nov 12 08:24 system_key.new
-rwxr-xr-x 1 elasticsearch elasticsearch 410 Nov 12 09:02 users => 用户信息
-rw------- 1 elasticsearch elasticsearch 0 Nov 9 06:28 users.new
-rwxr-xr-x 1 elasticsearch elasticsearch 85 Nov 12 09:02 users_roles => 用户与角色的映射
-rw------- 1 elasticsearch elasticsearch 0 Nov 9 06:28 users_roles.new
[[email protected] shield]#
默认的角色有：
admin
power_user
user
...eg1: 我们创建一个用户test_logstash 它只能访问 logstash-* 的indices
1.创建角色
[[email protected] shield]# vi /etc/elasticsearch/shield/roles.yml
...
...
logstash_user:
cluster: all
indices:
‘logstash-*‘: indices:data/read/search, indices:data/read/get, indices:admin/get => 读权限
...
...
2.创建用户并执行角色
[[email protected] shield]# /usr/share/elasticsearch/bin/shield/esusers useradd test_logstash -p test_logstash -r logstash_user
...
...
3. WEB UI 或 Terminate上校验，是否能访问logstash-*索引，是否能访问写，是否能访问其他的3. LDAP 验证