elasticsearch集成xpack加密_elastic存储加密

概述

2019年5月21日，Elastic官方发布消息： Elastic Stack 新版本6.8.0 和7.1.0的核心安全功能现免费提供。
这意味着用户现在能够对网络流量进行加密、创建和管理用户、定义能够保护索引和集群级别访问权限的角色.

本文章操作的前提：已经实现了elasticsearch集群。

具体操作

生成证书

bin/elasticsearch-certutil ca
1

生成p12密钥

bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12
1

查看生成的文件

mv elastic-* config/
1

将elastic-certificates.p12和elasticsearch.keystore文件分别也复制到其它结点的相同目录下

如果跟我一样是手动分发，一定要注意所属用户不能是root，还需要改一下所属用户

chgrp -R elasticsearch elastic-*
chown -R elasticsearch elastic-* 
1
2

这样就可以了
最后配置文件elasticsearch.yml添加以下内容

http.cors.allow-headers: Authorization
xpack.security.enabled: true
xpack.license.self_generated.type: basic
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: /usr/local/elasticsearch-7.6.2/config/elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: /usr/local/elasticsearch-7.6.2/config/elastic-certificates.p12
xpack.security.transport.ssl.keystore.password: xiaowuqin
xpack.security.transport.ssl.truststore.password: xiaowuqin
1
2
3
4
5
6
7
8
9

重启所有结点

bin/elasticsearch -d
1

最后一部，设置密码

bin/elasticsearch-setup-passwords interactive  xiaowuqin
1

这个interactive就是你自定义的密码(我自定义的xiaowuqin)

最后访问，可以看到，就需要密码认证了，收工~

springboot整合

依赖

 <dependency>
        <groupId>org.elasticsearch.client</groupId>
       <artifactId>elasticsearch-rest-client</artifactId>
       <version>7.6.2</version>
</dependency>
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-data-elasticsearch</artifactId>
</dependency>
<dependency>
    <groupId>org.elasticsearch.client</groupId>
    <artifactId>elasticsearch-rest-high-level-client</artifactId>
    <version>7.6.2</version>
</dependency>
1
2
3
4
5
6
7
8
9
10
11
12
13
14

具体代码

/*用户认证对象*/
        final CredentialsProvider credentialsProvider = new BasicCredentialsProvider();
        /*设置账号密码*/
        credentialsProvider.setCredentials(AuthScope.ANY,new UsernamePasswordCredentials("elastic", "xiaowuqin"));
        RestHighLevelClient client = new RestHighLevelClient(
                RestClient.builder(
                        new HttpHost("115.29.193.155", 9200, "http"),
                        new HttpHost("121.5.111.192", 9200, "http"),
                        new HttpHost("182.92.6.145", 9200, "http"))
                        .setHttpClientConfigCallback(new RestClientBuilder.HttpClientConfigCallback() {
                            @Override
                            public HttpAsyncClientBuilder customizeHttpClient(HttpAsyncClientBuilder httpAsyncClientBuilder) {
                                return httpAsyncClientBuilder.setDefaultCredentialsProvider(credentialsProvider);
                            }
                        }));
        MainResponse info = client.info(RequestOptions.DEFAULT);
        System.out.println("集群名字："+info.getClusterName());
        System.out.println("当前获得的结点名字"+info.getNodeName());
        client.close();
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19