Elasticsearch & Kibana with Shield
/opt/elasticsearch-2.3.2/bin/plugin install license
/opt/elasticsearch-2.3.2/bin/plugin install shield
或离线安装
[root@ela-master1 ~]#
/opt/elasticsearch-2.3.2/bin/plugin install
file:///root/license-2.3.2.zip
-> Installing from file:/root/license-2.3.2.zip...
Trying file:/root/license-2.3.2.zip ...
Downloading .DONE
Verifying file:/root/license-2.3.2.zip checksums if available ...
NOTE: Unable to verify checksum for downloaded plugin (unable to find .sha1 or .md5 file to verify)
Installed license into /opt/elasticsearch-2.3.2/plugins/license
[root@ela-master1 ~]# /opt/elasticsearch-2.3.2/bin/plugin install file:///root/shield-2.3.2.zip
-> Installing from file:/root/shield-2.3.2.zip...
Trying file:/root/shield-2.3.2.zip ...
Downloading .......................DONE
Verifying file:/root/shield-2.3.2.zip checksums if available ...
NOTE: Unable to verify checksum for downloaded plugin (unable to find .sha1 or .md5 file to verify)
Installed shield into /opt/elasticsearch-2.3.2/plugins/shield
shield.authc.realms.file1.type:
shield.authc.realms.file1.order:
HERE
2.启动(或重启)elasticsearch
3.创建file based用户
https://www.elastic.co/guide/en/shield/current/defining-roles.html#valid-role-name
https://www.elastic.co/guide/en/shield/current/enable-basic-auth.html
/opt/elasticsearch-2.3.2/bin/shield/esusers useradd es_admin -p P@ssw0rd -r admin
/opt/elasticsearch-2.3.2/bin/shield/esusers useradd kibana -p P@ssw0rd -r kibana4_server
[root@ela-client ~]# /opt/elasticsearch-2.3.2/bin/shield/esusers list
es_admin
kibana
/opt/elasticsearch-2.3.2/config/shield/users
/opt/elasticsearch-2.3.2/config/shield/users_roles
5.测试用户认证
[root@ela-client ~]# curl -u es_admin:P@ssw0rd 'http://localhost:9200/_cat/health?v'
epoch
1462705707
19:08:27
[root@ela-client ~]# curl -u es_admin:P@ssw0rd 'http://localhost:9200/_cat/indices?v'
health
status index
green
green
green
green
green
green
shield.authc.realms.native1.type:
shield.authc.realms.native1.order:
HERE
2.启动(或重启)elasticsearch
3.创建native用户
curl
{
}
'
说明:
1.新增native用户也需要认证,但启用了shield之后默认是没有native用户的,所以就需要借助file based用户来授权
2.native用户是存放在elasticsearch集群中,集群中的所有节点会自动同步
[root@ela-client ~]# curl -u es_admin:P@ssw0rd -XPOST 'http://localhost:9200/_shield/user/fooadmin' -d '
{
}
'
{"user":{"created":true}}
[root@ela-data1 ~]# curl -u es_admin:P@ssw0rd 'http://localhost:9200/_shield/user'
{"fooadmin":{"username":"fooadmin","roles":["admin","other_role1"],"full_name":"Jlive Liu","email":"iliujun_live@163.com","metadata":{"intelligence":7}}}
4.测试用户认证
[root@ela-master2 ~]# curl -u fooadmin:foo.123 'http://localhost:9200/_cat/health?v'
epoch
1462707192
19:33:12
/opt/kibana-4.5.0-linux-x64/bin/kibana plugin --install kibana/shield/2.3.2
或离线安装
wget
/opt/kibana-4.5.0-linux-x64/bin/kibana plugin --install shield --url file:///mnt/hgfs/linux_soft/ELK/shield-2.3.2.tar.gz
root@jlive:~#/opt/kibana-4.5.0-linux-x64/bin/kibana plugin --install shield --url file:///mnt/hgfs/linux_soft/ELK/shield-2.3.2.tar.gz
Installing shield
Attempting to transfer from file:///mnt/hgfs/linux_soft/ELK/shield-2.3.2.tar.gz
Transferring 7933036 bytes....................
Transfer complete
Extracting plugin archive
Extraction complete
Optimizing and caching browser bundles...
Plugin installation complete
kibana_elasticsearch_username:
kibana_elasticsearch_password:
shield.encryptionKey:
shield.sessionTimeout:
/opt/elasticsearch-2.3.2/config/shield/roles.yml
# The required permissions for the kibana 4 server
kibana4_server:
注意:默认的kibana4-server角色用户指对.kibana索引有全权限,但对其它indices没有任何权限,如果不指定在登录kibana后可能会出现如下情况
4.授权用户访问指定indices(所有elasticsearch节点)
可以修改原/opt/elasticsearch-2.3.2/config/shield/roles.yml默认定义的kibana4-server角色,也可以重新定义一个新角色,这里定义一个新角色kibana4_indices,能访问Kibana 官方示例中对应的indices
i.定义角色并授权
cat >>/opt/elasticsearch-2.3.2/config/shield/roles.yml <<HERE
kibana4_indices:
HERE
ii.用户授权
[root@ela-master2 ~]# /opt/elasticsearch-2.3.2/bin/shield/esusers roles kibana -a kibana4_indices
[root@ela-master2 ~]# /opt/elasticsearch-2.3.2/bin/shield/esusers list
es_admin
kibana
注意:所有的elasticsearch节点都要同步
5.重启elasticsearch集群
6.启动(或重启)kibana
B.native realm认证
上文中的native用户(fooadmin/foo.123)因为是admin用户,所以可以直接认证成功。
当然还可以单独建个kibana_native用户来认证
curl -u fooadmin:foo.123 -XPOST
'http://localhost:9200/_shield/user/kibana_native'
{
}
'
还是native认证方便,用户无需所有节点手动同步