StamusNetworks / SELKS

A Suricata based IDS/IPS/NSM distro
https://www.stamus-networks.com/open-source/#selks
GNU General Public License v3.0
1.47k stars 286 forks source link

Enable elasticsearch security? #301

Open michal25 opened 3 years ago

michal25 commented 3 years ago

After lates selks6 upgrade my SELKS device received a new version of elasticsearch. OK. I discovered the Elasticsearch Security function (Screenshot 3) and set the Screenshot_20210326_141620 Screenshot_20210326_141820 Screenshot_20210326_141900

xpack.security.enabled: true discovery.type: single-node

elasticsearch parameters.

And now, when I try to enter in the Kibana screen (Screenshot 1), I will receive the

{"statusCode":503,"error":"Service Unavailable","message":"License is not available."}

What I can do now?

My SELKS6 version looks this:

Mar 26 14:05:39 SELKS60 systemd[1]: Started Moloch Pcap Read. scirius RUNNING pid 792, uptime 0:09:45 ii elasticsearch 7.12.0 amd64 Distributed RESTful search engine built for the cloud ii elasticsearch-curator 5.8.3 amd64 Have indices in Elasticsearch? This is the tool for you!\n\nLike a museum curator manages the exhibits and collections on display, \nElasticsearch Curator helps you curate, or manage your indices. ii evebox 1:0.13.0 amd64 no description given ii kibana 7.12.0 amd64 Explore and visualize your Elasticsearch data ii kibana-dashboards-stamus 2020122001 amd64 Kibana 6 dashboard templates. ii logstash 1:7.12.0-1 amd64 An extensible logging pipeline ii moloch 2.7.1-1 amd64 Moloch Full Packet System ii scirius 3.7.0-1 amd64 Django application to manage Suricata ruleset ii suricata 1:2021030201-0stamus0 amd64 Suricata open source multi-thread IDS/IPS/NSM system. Filesystem Type Size Used Avail Use% Mounted on udev devtmpfs 3.9G 0 3.9G 0% /dev tmpfs tmpfs 798M 8.6M 790M 2% /run /dev/vda1 ext4 188G 9.3G 170G 6% / tmpfs tmpfs 3.9G 0 3.9G 0% /dev/shm tmpfs tmpfs 5.0M 0 5.0M 0% /run/lock tmpfs tmpfs 3.9G 0 3.9G 0% /sys/fs/cgroup tmpfs tmpfs 798M 0 798M 0% /run/user/1001

pevma commented 3 years ago

For xpack you might want to try - https://github.com/StamusNetworks/scirius/issues/224#issuecomment-805769089
Can you please test it out if possible ?