https://www.elastic.co/guide/en/shield/shield-1.3/introduction.html
一、简介
Shield是Elasticsearch的一个插件，它能够很容易的保证你的Elasticsearch集群的安全性。
Shield的功能：
1.用户认证
2.SSL/TLS的加密身份验证
3.审计
二、安装
我使用的shield-1.3的版本
-
安装Elasticsearch集群
-
Shield是需要licese的，我们只有在offline机器上安装使用
a.下载license https://download.elastic.co/elasticsearch/license/license-latest.zip
[root@hftclclw0001 usr]# pwd
/usr
[root@hftclclw0001 usr]# wget https://download.elastic.co/elasticsearch/license/license-latest.zip
...
...b. 下载 shield https://download.elastic.co/elasticsearch/shield/shield-latest.zip
[root@hftclclw0001 usr]# pwd
/usr
[root@hftclclw0001 usr]# wget https://download.elastic.co/elasticsearch/shield/shield-latest.zip
...
...c. 安装license 和 shield
注意/usr/share/elasticsearch/ 是elasticsearch的安装目录
是本地文件的协议前缀
[root@hftclclw0001 usr]# /usr/share/elasticsearch/bin/plugin -i license -u file:///usr/license-latest.zip
...
...
[root@hftclclw0001 usr]# /usr/share/elasticsearch/bin/plugin -i license -u file:///usr/shield-latest.zip
...
...
校验：
[root@hftclclw0001 usr]# ll /usr/share/elasticsearch/plugins/
...
...
license
shield
...
[root@hftclclw0001 usr]# curl -XGET ' => 此时是无法访问的，需要身份验证
...
首先创建一个管理员
[root@hftclclw0001 plugins]# /usr/share/elasticsearch/bin/shield/esusers useradd es_admin -r admin
...
[root@hftclclw0001 usr]# curl -XGET -u es_admin:{passwd} 'http://{ip}:9200/'三、消息认证(enable message authentication)
https://www.elastic.co/guide/en/shield/shield-1.3/enable-message-authentication.html
消息验证会验证消息传输过程中是否被篡改等
1.生成key
[root@hftclclw0001 shield]# /usr/share/elasticsearch/bin/shield/syskeygen
...
会生成 ES_HOME/config/shield/system_key
然后再elasticsearch.yml 中配置
shield.system_key.file=
2.复制key到其他各个节点上，各个节点必须相同
四、用户认证配置(setting up user authentication)
为了获取受限资源权限，用户必须提供身份校验信息。如密码等。
1.esusers
是shield内置一种方式
https://www.elastic.co/guide/en/shield/shield-1.3/esusers.html
https://www.elastic.co/guide/en/shield/shield-1.3/_managing_users_in_an_esusers_realm.html
添加用户(Adding User)
[root@hftclclw0001 plugins]# /usr/share/elasticsearch/bin/shield/esusers useradd test_1
会提示让你输入密码，
[root@hftclclw0001 plugins]# /usr/share/elasticsearch/bin/shield/esusers useradd test-1 -p test_1
这样就会创建一个用户test_1 密码是 test_1
[root@hftclclw0001 plugins]# /usr/share/elasticsearch/bin/shield/esusers list
#【userid】: 【roleid】
...
test_1 : -
...
默认角色是 - 也没有啥权限，稍后会说明角色与权限
修改用户密码(Managing User Passwords)
[root@hftclclw0001 plugins]# /usr/share/elasticsearch/bin/shield/esusers passwd test-1 -p test_1
2. 基于角色的访问控制
https://www.elastic.co/guide/en/shield/shield-1.3/configuring-rbac.html
定义角色(Defining Roles)
roles.yml
[root@hftclclw0001 shield]# pwd
/etc/elasticsearch/shield
[root@hftclclw0001 shield]# ll
total 36
-rwxr-xr-x 1 elasticsearch elasticsearch 1119 Nov 9 05:21 logging.yml
-rw------- 1 elasticsearch elasticsearch 1119 Nov 9 06:28 logging.yml.new
-rwxr-xr-x 1 elasticsearch elasticsearch 473 Nov 9 05:21 role_mapping.yml
-rw------- 1 elasticsearch elasticsearch 473 Nov 9 06:28 role_mapping.yml.new
-rwxr-xr-x 1 elasticsearch elasticsearch 2634 Nov 12 09:06 roles.yml => 角色与权限的映射
-rw------- 1 elasticsearch elasticsearch 2699 Nov 9 06:28 roles.yml.new
-rw------- 1 elasticsearch elasticsearch 128 Nov 12 08:24 system_key.new
-rwxr-xr-x 1 elasticsearch elasticsearch 410 Nov 12 09:02 users => 用户信息
-rw------- 1 elasticsearch elasticsearch 0 Nov 9 06:28 users.new
-rwxr-xr-x 1 elasticsearch elasticsearch 85 Nov 12 09:02 users_roles => 用户与角色的映射
-rw------- 1 elasticsearch elasticsearch 0 Nov 9 06