????????2019年1月30日，外媒又報道了一起Elasticsearch數(shù)據(jù)泄露事件！2019年1月份的至少有6起Elasticsearch數(shù)據(jù)泄露事件了。原因何在，很簡單，開發(fā)者在服務啟動之后總是懶得去修改，哪怕是添加個密碼，不信？你去看看你們公司的REDIS服務器，看看有多少設置了密碼，至少我公司不相關的部門的業(yè)務，他們的REDIS我都能遠程登錄(因?qū)雨P系我知道了redis服務器IP)。
好吧，回到Elasticsearch7.7的密碼設置問題上來吧，說說我遇到的Elasticsearch設置賬號密碼時的矛盾問題，很扯蛋。不過也不要上綱上線，因為這問題肯定是可以解決的，但我在寫這篇筆記的時候還沒有找到方法，而我又想基于此留下點筆記。操作過程如下：
#1.開始給elasticsearch設置密碼
tiger@n21-045-025:/usr/share/elasticsearch$ sudo bin/elasticsearch-setup-passwords interactive
It doesn't look like the X-Pack security feature is enabled on?this?Elasticsearch node.
Please check?if?you have enabled X-Pack security in your elasticsearch.yml configuration file.
ERROR: X-Pack Security is disabled by configuration.
#提示沒有在配置文件中開啟X-Pack，OK
#2.開啟X-Pack配置
tiger@n21-045-025:/opt/elasticsearch$ sudo vim /etc/elasticsearch/elasticsearch.yml
http.cors.enabled:?true
http.cors.allow-origin:?"*"
#新增加了以下兩行配置
xpack.security.enabled:?true
xpack.security.transport.ssl.enabled:?true
#3.增加完配置之后要重啟elasticsearch不？你說不重啟能行嗎?不重啟就還是沒有配置啊。
#重啟elasticsearch之后，然后我們再來配置密碼
#修改完配置重啟es之后使用elasticsearch-setup-passwords interactive
tiger@n21-045-025:/usr/share/elasticsearch$ sudo bin/elasticsearch-setup-passwords interactive
#Initiating the setup of passwords?for?reserved users elastic,apm_system,kibana,logstash_system,beats_system,remote_monitoring_user.
Enter password?for?[elastic]:
Reenter password?for?[elastic]:
Enter password?for?[apm_system]:
Reenter password?for?[apm_system]:
Enter password?for?[kibana]:
Reenter password?for?[kibana]:
Enter password?for?[logstash_system]:
Reenter password?for?[logstash_system]:
Enter password?for?[beats_system]:
Reenter password?for?[beats_system]:
Enter password?for?[remote_monitoring_user]:
Reenter password?for?[remote_monitoring_user]:
Unexpected response code [503] from calling PUT http://192.21.15.25:9200/_security/user/apm_system/_password?pretty
Cause: Cluster state has not been recovered yet, cannot write to the [null] index
Possible next steps:
* Try running?this?tool again.
* Try running with the --verbose parameter?for?additional messages.
* Check the elasticsearch logs?for?additional error details.
* Use the change password API manually.
ERROR: Failed to set password?for?user [apm_system]#看設置報錯：
tiger@n21-045-025:/usr/share/elasticsearch$ sudo bin/elasticsearch-setup-passwords interactive --verbose
Running with configuration path: /etc/elasticsearch
Testing?if?bootstrap password is valid?for?http://192.21.15.25:9200/_security/_authenticate?pretty
Checking cluster health: http://192.21.15.25:9200/_cluster/health?pretty
{
??"error"?: {
????"root_cause"?: [
??????{
????????"type"?:?"master_not_discovered_exception",
????????"reason"?:?null
??????}
????],
????"type"?:?"master_not_discovered_exception",
????"reason"?:?null
??},
??"status"?:?503
}
Failed to determine the health of the cluster running at http://192.21.15.25:9200
Unexpected response code [503] from calling GET http://192.21.15.25:9200/_cluster/health?pretty
Cause: master_not_discovered_exception
It is recommended that you resolve the issues with your cluster before running elasticsearch-setup-passwords.
It is very likely that the password changes will fail when run against an unhealthy cluster.
Do you want to?continue?with the password setup process [y/N]ERROR: User cancelled operation????????看上面的報錯，這時提示9200服務報503錯誤，什么原因呢？我設置了要要賬號密碼啊?，F(xiàn)在從瀏覽器訪問9200端口也是需要賬號密碼才能登錄的，請求http://192.21.15.25:9200/_cluster/health?pretty接口也會阻塞一直不響應，因為在等待賬號密碼呢。
這就矛盾了：我沒啟用xpack.security.enabled時，不能進入設置密碼。但我啟動了之后設置密碼時它會調(diào)用_cluster/health?pretty檢查集群狀態(tài)然后就有問題了。這不矛盾了嗎？
????????網(wǎng)上找了一些資料，包括google,但也都沒有解決：比如 https://stackoverflow.com/questions/61884976/apply-security-on-elk-cluster-authentication-issue 這里說把所有的節(jié)點都加上上面的X-pack配置重啟，然后使用auto進行密碼設置。一樣會出現(xiàn)無法檢查集群健康狀態(tài)的問題。Failed to determine the health of the cluster running at http://192.21.15.25:9200 Unexpected response code [503] from calling GET http://192.21.15.25:9200/_cluster/health?pretty文章來源：http://www.zghlxwxcb.cn/news/detail-511633.html
????????這個肯定不能是個問題！這個也一定能解決的，暫時挺腦火，留個筆記在這里！文章來源地址http://www.zghlxwxcb.cn/news/detail-511633.html
到了這里，關于Elasticsearch7.7設置賬號密碼時的邏輯矛盾問題的文章就介紹完了。如果您還想了解更多內(nèi)容，請在右上角搜索TOY模板網(wǎng)以前的文章或繼續(xù)瀏覽下面的相關文章，希望大家以后多多支持TOY模板網(wǎng)！
