初中信息科技怎么自己做网站/2023半夜免费b站推广

ca 文件生成

instances.yml 配置

[root@node1 ~]# cat /etc/elasticsearch/instances.yml 
instances:- name: "elasticsearch781"ip:- "10.10.200.211"- "10.10.200.212"- "10.10.200.213"filename: "elasticsearch"

生成秘钥文件

[root@node1 ~]# /usr/share/elasticsearch/bin/elasticsearch-certutil cert ca --pem --silent --in /etc/elasticsearch/instances.yml --out cert.zip 

分发秘钥文件

[root@node1 ~]# unzip cert.zip -d /usr/local/elasticsearch/config

elasticsearch.yml 配置

[root@node1 ~]# tail -10 /usr/local/elasticsearch/config/elasticsearch.yml 
xpack.security.enabled: true
# xpack.security.http.ssl.enabled: true
xpack.security.transport.ssl.enabled: true
# xpack.security.http.ssl.key: elasticsearch/elasticsearch.key
# xpack.security.http.ssl.certificate: elasticsearch/elasticsearch.crt
# xpack.security.http.ssl.certificate_authorities: ca/ca.crt
xpack.security.transport.ssl.key: elasticsearch/elasticsearch.key
xpack.security.transport.ssl.certificate: elasticsearch/elasticsearch.crt
xpack.security.transport.ssl.certificate_authorities: ca/ca.crt

用户创建

生成超级管理员

[root@node1 ~]# /usr/local/elasticsearch/bin/elasticsearch-setup-passwords auto -u http://10.10.200.211:9200
Initiating the setup of passwords for reserved users elastic,apm_system,kibana,kibana_system,logstash_system,beats_system,remote_monitoring_user.
The passwords will be randomly generated and printed to the console.
Please confirm that you would like to continue [y/N]y  # 此处输入 "y" 继续Changed password for user apm_system
PASSWORD apm_system = xL9OeSkOD3R6ChO6uyFvChanged password for user kibana_system
PASSWORD kibana_system = DGVb03kPVE6Ax6zOhQ1xChanged password for user kibana
PASSWORD kibana = DGVb03kPVE6Ax6zOhQ1xChanged password for user logstash_system
PASSWORD logstash_system = o65ECI3CfHX2wmLfX3rfChanged password for user beats_system
PASSWORD beats_system = nf0FaarGvceixSS2zvdwChanged password for user remote_monitoring_user
PASSWORD remote_monitoring_user = hPVFu4yF21H8J2uTX9xGChanged password for user elastic
PASSWORD elastic = XkTTXlL0MPl8Hdf05Jgi

通过超级管理员创建角色

• read 角色

[root@node1 ~]# curl -u elastic:XkTTXlL0MPl8Hdf05Jgi -XPOST 10.10.200.211:9200/_security/role/readIndex -H 'Content-Type: application/json' -d 
'{"run_as": ["watcher_user"],"cluster": ["monitor"],"indices": [{"names": ["index*"],"privileges": ["read"]}]
}'

• write 角色

[root@node1 ~]# curl -u elastic:XkTTXlL0MPl8Hdf05Jgi -XPOST 10.10.200.211:9200/_security/role/writeIndex -H 'Content-Type: application/json' -d 
'{"run_as": ["watcher_user"],"cluster": ["monitor"],"indices": [{"names": ["index*"],"privileges": ["write"]}]
}'

• monitor 角色

[root@node1 ~]# curl -u elastic:XkTTXlL0MPl8Hdf05Jgi -XPOST 10.10.200.211:9200/_security/role/monitorIndex -H 'Content-Type: application/json' -d 
'{"run_as": ["watcher_user"],"cluster": ["monitor"],"indices": [{"names": ["index*"],"privileges": ["monitor"]}]
}'

• manage 角色

[root@node1 ~]# curl -u elastic:XkTTXlL0MPl8Hdf05Jgi -XPOST 10.10.200.211:9200/_security/role/manageIndex -H 'Content-Type: application/json' -d 
'{"run_as": ["watcher_user"],"cluster": ["monitor"],"indices": [{"names": ["index*"],"privileges": ["manage"]}]
}'

• create_index 角色

[root@node1 ~]# curl -u elastic:XkTTXlL0MPl8Hdf05Jgi -XPOST 10.10.200.211:9200/_security/role/createIndex -H 'Content-Type: application/json' -d 
'{"run_as": ["watcher_user"],"cluster": ["monitor"],"indices": [{"names": ["index*"],"privileges": ["create_index"]}]
}'

通过超级管理员创建用户

• readIndex 用户

[root@node1 ~]# curl -u elastic:XkTTXlL0MPl8Hdf05Jgi -XPOST 10.10.200.211:9200/_security/user/readIndex -H 'Content-Type: application/json' -d 
'{"password": "readIndex1234","roles": ["readIndex"]
}'

• writeIndex 用户

[root@node1 ~]# curl -u elastic:XkTTXlL0MPl8Hdf05Jgi -XPOST 10.10.200.211:9200/_security/user/writeIndex -H 'Content-Type: application/json' -d 
'{"password": "writeIndex1234","roles": ["writeIndex"]
}'

• monitorIndex 用户

[root@node1 ~]# curl -u elastic:XkTTXlL0MPl8Hdf05Jgi -XPOST 10.10.200.211:9200/_security/user/monitorIndex -H 'Content-Type: application/json' -d 
'{"password": "monitorIndex1234","roles": ["monitorIndex"]
}'

• managerIndex 用户

[root@node1 ~]# curl -u elastic:XkTTXlL0MPl8Hdf05Jgi -XPOST 10.10.200.211:9200/_security/user/manageIndex -H 'Content-Type: application/json' -d 
'{"password": "manageIndex1234","roles": ["manageIndex"]
}'

• createIndex 用户

[root@node1 ~]# curl -u elastic:XkTTXlL0MPl8Hdf05Jgi -XPOST 10.10.200.211:9200/_security/user/createIndex -H 'Content-Type: application/json' -d 
'{"password": "createIndex1234","roles": ["createIndex"]
}'

验证测试

HTTP 方式连接

• 当前节点可用性查看

[root@node1 ~]# curl -u elastic:XkTTXlL0MPl8Hdf05Jgi -XGET 10.10.200.211:9200

• 集群健康状态查看

[root@node1 ~]# curl -u elastic:XkTTXlL0MPl8Hdf05Jgi -XGET 10.10.200.211:9200/_cat/health

• 集群节点信息查看

[root@node1 ~]# curl -u elastic:XkTTXlL0MPl8Hdf05Jgi -XGET 10.10.200.211:9200/_cat/nodes

• 集群内索引查看

[root@node1 ~]# curl -u elastic:XkTTXlL0MPl8Hdf05Jgi -XGET 10.10.200.211:9200/_cat/indices

Java Client TCP 连接

import org.elasticsearch.xpack.client.PreBuiltXPackTransportClient;
...TransportClient client = new PreBuiltXPackTransportClient(Settings.builder().put("cluster.name", "myClusterName").put("xpack.security.user", "transport_client_user:x-pack-test-password").put("xpack.security.transport.ssl.enabled", true).put("xpack.security.transport.ssl.key", "/path/to/client.key").put("xpack.security.transport.ssl.certificate", "/path/to/client.crt").put("xpack.security.transport.ssl.certificate_authorities", "/path/to/ca.crt").put("xpack.security.transport.ssl.enabled", "true")....build()).addTransportAddress(new TransportAddress(InetAddress.getByName("localhost"), 9300)).addTransportAddress(new TransportAddress(InetAddress.getByName("localhost"), 9301))

参考

• ElasticSearch License 申请地址
• ElasticSearch 不同版本 License 区别
• 申请 ElasticSearch 中 x-pack 插件许可证及授权
• Python ElasticSearch API
• Java Client And Security – 7.x 版本
• Python 对接 ElasticSearch 的基本操作
• 配置 SSL、TLS 以及 HTTPS 来确保 Elasticsearch、Kibana、Beats 和 Logstash 的安全
• elasticsearch-certutil 工具生成秘钥文件