ELK系列(九)、配置ES和Kibana的用户密码

我会带着你远行 2023-02-12 11:24 11阅读 0赞

前面介绍的都是没有设置密码的情况，ES默认没有密码，什么数据泄露的新闻简直是家常便饭，所以这里还是建议大家给ES和kibana设置用户登陆，或者使用nginx限制IP或用户访问。本文介绍ELK自带的创建用户的方式。

[ELK系列(一)、安装ElasticSearch+Logstash+Kibana+Filebeat-v7.7.0][ELK_ElasticSearch_Logstash_Kibana_Filebeat-v7.7.0]

[ELK系列(二)、在Kibana中使用RESTful操作ES库][ELK_Kibana_RESTful_ES]

[ELK系列(三)、安装Logstash插件及打包离线安装包][ELK_Logstash]

[ELK系列(四)、Logstash读取nginx日志写入ES中][ELK_Logstash_nginx_ES]

[ELK系列(五)、Logstash修改@timestamp时间为日志的产生时间][ELK_Logstash_timestamp]

[ELK系列(六)、修改Nginx日志为Json格式并使用Logstash导入至ES][ELK_Nginx_Json_Logstash_ES]

[ELK系列(七)、Filebeat+Logstash采集多个日志文件并写入不同的ES索引中][ELK_Filebeat_Logstash_ES]

[ELK系列(八)、使用Filebeat+Redis+Logstash收集日志数据][ELK_Filebeat_Redis_Logstash]

\-------------------------------------创建ELK的用户------------------------------

# 修改ES配置开启X-PACK #

*vim /opt/app/elasticsearch-7.7.0/config/elasticsearch.yml *

http.cors.enabled: true
    http.cors.allow-origin: "*"
    http.cors.allow-headers: Authorization
    xpack.security.enabled: true
    xpack.security.transport.ssl.enabled: true

# 重启ES #

*sudo -u elk nohup $ES\_HOME/bin/elasticsearch >> $ES\_HOME/output.log 2>&1 &*

# 创建用户 #

*cd $ES\_HOME*

*bin/elasticsearch-setup-passwords interactive*

[root@node01 elasticsearch-7.7.0]# bin/elasticsearch-setup-passwords interactive
    future versions of Elasticsearch will require Java 11; your Java version from [/opt/app/jdk1.8.0_181/jre] does not meet this requirement
    Initiating the setup of passwords for reserved users elastic,apm_system,kibana,logstash_system,beats_system,remote_monitoring_user.
    You will be prompted to enter passwords as the process progresses.
    Please confirm that you would like to continue [y/N]y
    
    
    Enter password for [elastic]: 
    Reenter password for [elastic]: 
    Enter password for [apm_system]: 
    Reenter password for [apm_system]: 
    Enter password for [kibana]: 
    Reenter password for [kibana]: 
    Enter password for [logstash_system]: 
    Reenter password for [logstash_system]: 
    Enter password for [beats_system]: 
    Reenter password for [beats_system]: 
    Enter password for [remote_monitoring_user]: 
    Reenter password for [remote_monitoring_user]: 
    Changed password for user [apm_system]
    Changed password for user [kibana]
    Changed password for user [logstash_system]
    Changed password for user [beats_system]
    Changed password for user [remote_monitoring_user]
    Changed password for user [elastic]

# 修改Kibana配置 #

*/opt/app/kibana-7.7.0-linux-x86\_64/config/kibana.yml *

elasticsearch.username: "kibana"
    elasticsearch.password: "123456"

# 重启kibana #

*sudo -u elk  nohup $KB\_HOME/bin/kibana > $KB\_HOME/output.log 2>&1 &*

# 验证 #

访问ES需要密码：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dzZGMwNTIx_size_16_color_FFFFFF_t_70][]

访问kibana需要密码：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dzZGMwNTIx_size_16_color_FFFFFF_t_70 1][]

在kibana中可以新增用户，对用户和角色进行管理

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dzZGMwNTIx_size_16_color_FFFFFF_t_70 2][]

**使用curl命令访问带有安全认证的ES:**

curl --user elastic:123456 -X GET http://uathd02:9200/noah/_doc/1?pretty
    
    [tools@uatgw01 ~]$ curl --user elastic:123456 -X GET http://uathd02:9200/noah/_doc/1?pretty
    {
      "_index" : "noah",
      "_type" : "_doc",
      "_id" : "1",
      "_version" : 1,
      "_seq_no" : 1,
      "_primary_term" : 1,
      "found" : true,
      "_source" : {
        "name" : "王义凯",
        "age" : 28,
        "email" : "wangyikai@csdn.com",
        "company" : "CSDN"
      }
    }

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dzZGMwNTIx_size_16_color_FFFFFF_t_70 3][]

如果想取消用户密码登陆的话，只需要把第一步里面的ES的那几个配置注释并重启ES即可，然后登陆ES和Kiabana就不需要密码了，但是不建议这么做。

最后再次提醒大家，线上的ES一定要注意数据保护，开启防火墙，最好不要把端口暴露到公网，禁用ES批量删除索引功能。

希望本文对你有帮助，请点个赞鼓励一下作者吧~ 谢谢！

[ELK_ElasticSearch_Logstash_Kibana_Filebeat-v7.7.0]: https://blog.csdn.net/wsdc0521/article/details/106236499
[ELK_Kibana_RESTful_ES]: https://blog.csdn.net/wsdc0521/article/details/106241596
[ELK_Logstash]: https://blog.csdn.net/wsdc0521/article/details/106292639
[ELK_Logstash_nginx_ES]: https://blog.csdn.net/wsdc0521/article/details/106306584
[ELK_Logstash_timestamp]: https://blog.csdn.net/wsdc0521/article/details/106307452
[ELK_Nginx_Json_Logstash_ES]: https://blog.csdn.net/wsdc0521/article/details/106307938
[ELK_Filebeat_Logstash_ES]: https://blog.csdn.net/wsdc0521/article/details/106308441
[ELK_Filebeat_Redis_Logstash]: https://blog.csdn.net/wsdc0521/article/details/106344073
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dzZGMwNTIx_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/2020052523390582.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dzZGMwNTIx,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dzZGMwNTIx_size_16_color_FFFFFF_t_70 1]: https://img-blog.csdnimg.cn/20200525233918340.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dzZGMwNTIx,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dzZGMwNTIx_size_16_color_FFFFFF_t_70 2]: https://img-blog.csdnimg.cn/20200525233925981.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dzZGMwNTIx,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dzZGMwNTIx_size_16_color_FFFFFF_t_70 3]: https://img-blog.csdnimg.cn/2020052616174811.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dzZGMwNTIx,size_16,color_FFFFFF,t_70