Elasticsearch7.7设置账号密码时的逻辑矛盾问题和文章相关评论

news2024/11/17 17:53:17

一、Elasticsearch7.7设置账号密码时的逻辑矛盾问题

publish:June 19, 2020 -Friday 2019年1月30日，外媒又报道了一起Elasticsearch数据泄露事件！2019年1月份的至少有6起Elasticsearch数据泄露事件了。原因何在，很简单，开发者在服务启动之后总是懒得去修改，哪怕是添加个密码，不信？你去看看你们公司的REDIS服务器，看看有多少设置了密码，至少我公司不相关的部门的业务，他们的REDIS我都能远程登录(因对接关系我知道了redis服务器IP)。

好吧，回到Elasticsearch7.7的密码设置问题上来吧，说说我遇到的Elasticsearch设置账号密码时的矛盾问题，很扯蛋。不过也不要上纲上线，因为这问题肯定是可以解决的，但我在写这篇笔记的时候还没有找到方法，而我又想基于此留下点笔记。操作过程如下：

#1.开始给elasticsearch设置密码
tiger@n21-045-025:/usr/share/elasticsearch$ sudo bin/elasticsearch-setup-passwords interactive
It doesn't look like the X-Pack security feature is enabled on this Elasticsearch node.
Please check if you have enabled X-Pack security in your elasticsearch.yml configuration file.
ERROR: X-Pack Security is disabled by configuration.
#提示没有在配置文件中开启X-Pack，OK
#2.开启X-Pack配置
tiger@n21-045-025:/opt/elasticsearch$ sudo vim /etc/elasticsearch/elasticsearch.yml
http.cors.enabled: true
http.cors.allow-origin: "*"
#新增加了以下两行配置
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
#3.增加完配置之后要重启elasticsearch不？你说不重启能行吗?不重启就还是没有配置啊。
#重启elasticsearch之后，然后我们再来配置密码
#修改完配置重启es之后使用elasticsearch-setup-passwords interactive
tiger@n21-045-025:/usr/share/elasticsearch$ sudo bin/elasticsearch-setup-passwords interactive
#Initiating the setup of passwords for reserved users elastic,apm_system,kibana,logstash_system,beats_system,remote_monitoring_user.
Enter password for [elastic]: 
Reenter password for [elastic]: 
Enter password for [apm_system]: 
Reenter password for [apm_system]: 
Enter password for [kibana]: 
Reenter password for [kibana]: 
Enter password for [logstash_system]: 
Reenter password for [logstash_system]: 
Enter password for [beats_system]: 
Reenter password for [beats_system]: 
Enter password for [remote_monitoring_user]: 
Reenter password for [remote_monitoring_user]: 
Unexpected response code [503] from calling PUT http://192.21.15.25:9200/_security/user/apm_system/_password?pretty
Cause: Cluster state has not been recovered yet, cannot write to the [null] index
Possible next steps:
* Try running this tool again.
* Try running with the --verbose parameter for additional messages.
* Check the elasticsearch logs for additional error details.
* Use the change password API manually. 
ERROR: Failed to set password for user [apm_system]
#看设置报错：
tiger@n21-045-025:/usr/share/elasticsearch$ sudo bin/elasticsearch-setup-passwords interactive --verbose
Running with configuration path: /etc/elasticsearch
Testing if bootstrap password is valid for http://192.21.15.25:9200/_security/_authenticate?pretty
Checking cluster health: http://192.21.15.25:9200/_cluster/health?pretty
{
  "error" : {
    "root_cause" : [
      {
        "type" : "master_not_discovered_exception",
        "reason" : null
      }
    ],
    "type" : "master_not_discovered_exception",
    "reason" : null
  },
  "status" : 503
}
Failed to determine the health of the cluster running at http://192.21.15.25:9200
Unexpected response code [503] from calling GET http://192.21.15.25:9200/_cluster/health?pretty
Cause: master_not_discovered_exception
It is recommended that you resolve the issues with your cluster before running elasticsearch-setup-passwords.
It is very likely that the password changes will fail when run against an unhealthy cluster.
Do you want to continue with the password setup process [y/N]ERROR: User cancelled operation

看上面的报错，这时提示9200服务报503错误，什么原因呢？我设置了要要账号密码啊。现在从浏览器访问9200端口也是需要账号密码才能登录的，请求 http://192.21.15.25:9200/_cluster/health?pretty 接口也会阻塞一直不响应，因为在等待账号密码呢。

这就矛盾了：我没启用xpack.security.enabled时，不能进入设置密码。但我启动了之后设置密码时它会调用_cluster/health?pretty检查集群状态然后就有问题了。这不矛盾了吗？
网上找了一些资料，包括google,但也都没有解决：比如 elasticsearch - Apply security on ELK Cluster - authentication issue - Stack Overflow 这里说把所有的节点都加上上面的X-pack配置重启，然后使用auto进行密码设置。一样会出现无法检查集群健康状态的问题。Failed to determine the health of the cluster running at http://192.21.15.25:9200 Unexpected response code [503] from calling GET http://192.21.15.25:9200/_cluster/health?pretty

这个肯定不能是个问题！这个也一定能解决的，暂时挺脑火，留个笔记在这里！