Jymit
commented
6 years ago DO Droplet - Centos 7.5 x64
$ yum update && yum install docker epel-release net-tools git python-pip wget java nmap fail2ban zip unzip -y
$ wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.3.1.rpm
$ rpm --install elasticsearch-6.3.1.rpm
$ find / -name elasticsearch
$ sudo systemctl start elasticsearch.service
$ journalctl -f
$ ifconfig -a |grep inet
$ tailf /var/log/elasticsearch/moshimoshi.log
$ free -h && sync && echo 3 > /proc/sys/vm/drop_caches && free -h
$ egrep '^[^#]+' elasticsearch.yml
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
cluster.name: moshimoshi
http.port: 9200
network.host: centos-elk
$ egrep '^[^#]+' /etc/hosts
127.0.0.1 centos-elk centos-elk
127.0.0.1 localhost.localdomain localhost
127.0.0.1 localhost4.localdomain4 localhost4
178.128.38.xxx centos-elk centos-elk
::1 centos-elk centos-elk
::1 localhost.localdomain localhost
::1 localhost6.localdomain6 localhost6
$ egrep '^[^#]+' jvm.options
-Xms300m
-Xmx300m
$ /usr/share/elasticsearch/bin/elasticsearch-certutil ca --pem
$ /usr/share/elasticsearch/bin/elasticsearch-certutil cert --ca-cert ca/ca.crt --ca-key ca/ca.key --out certs.zip -pem
$ egrep '^[^#]+' /etc/elasticsearch/elasticsearch.yml
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
cluster.name: moshimoshi
network.host: centos-elk
http.port: 9200
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.key: /etc/elasticsearch/instance/instance.key
xpack.security.transport.ssl.certificate: /etc/elasticsearch/instance/instance.crt
xpack.security.transport.ssl.certificate_authorities: [ "/etc/elasticsearch/ca/ca.crt" ]
xpack.security.http.ssl.enabled: true
xpack.security.http.ssl.verification_mode: certificate
xpack.security.http.ssl.key: /etc/elasticsearch/instance/instance.key
xpack.security.http.ssl.certificate: /etc/elasticsearch/instance/instance.crt
xpack.security.http.ssl.certificate_authorities: [ "/etc/elasticsearch/ca/ca.crt" ]Will build this on Darwin (Mac) and Linux (Centos 7)
- So first we need to check OS
$ vi osChecker.sh #!/bin/sh
who=$(whoami) os=$(uname)
function osCheck(){ if [[ $os = "Darwin" ]]; then echo "Darwin" #Mac elif [[ $os = "Linux" ]]; then echo "Linux" #Linux else echo " Unknown OS, please raise this with your support contact" fi }
echo $(osCheck)
function whoAreYou(){
if [[ $who = "root" ]]; then
echo "Root! - Be careful!"
else
echo "You are running as user $who"
fi
}
echo $(whoAreYou)
- On my dropletLinux Root! - Be careful!
- LaptopDarwin You are running as user khondhu
- Prompt for ES IP and Prt
- Next check is ES up
$ vi prompter.sh
!/bin/sh
read -p "Enter Elasticsearch cluster IP: " cluster_ip read -p "Enter Elasticsearch cluster Port: " cluster_port read -p "HTTP OR HTTPS: " es_protocol
echo You entered an Elasticsearch cluster $es_protocol://$cluster_ip:$cluster_port sleep 1 echo Lets curl to check. sleep 1 curl -s $es_protocol://$cluster_ip:$cluster_port sleep 1
SSL/TLS troubleshooting script
Elastic Stack v6.3.0Create and test on single node with P12 (PKCS#12) bundle.
Stop Elasticsearch, Kibana.
Update yaml.
SSL Certificate API docs here.
Iteration 1.
. .. . .. . .. . .. . Other things to note and work on.
Troubleshooting things to add. PEM single node cluster v624 SSL/TLS for HTTP & TRANSPORT:
http.
https.
with ca.
ca and auth
Add openssl clauses into the script
Check a PKCS#12 file (.pfx or .p12): $ openssl pkcs12 -info -in elastic-certificates.p12
The key part here is the 2.16.840.1.113894.746875.1.1 This is Oracle's OID for a trusted CA entry in a PKCS#12.
We assume that the PKCS#12 contains the certificate chain. That's usually true, but not always. If the
openssl pkcs12 -infocommand outputs multiple---- BEGIN CERTIFICATEblocks, then the PKCS#12 contains the full chain, and this should all work fine. If it has only a single certificate block, then the customer will need to get their CA cert from elsewhere.