ElasticSearch7.6.0与LDAP的安全认证

一、使用Docker安装ES和Kibana

docker run -d --name es -p 9200:9200 -p 9300:9300 -e "discovery.type=single-node" elasticsearch:7.6.0

docker run -d --name kibana -p 5601:5601 kibana:7.6.0

二、OpenLDAP环境信息测试

yum install openldap-clients.x86_64 -y

# 例：搜索LDAP中某个用户
ldapsearch -x -H ldap://192.168.1.10:389 -b uid=zhangsan,ou=users,dc=test,dc=com -D "cn=root,dc=test,dc=com" -w $PASSWD

三、关于ES XPack

LDAP认证功能，需要以下步骤进行修改：

1、将以下两个源码文件在容器内编译并替换

LicenseVerifier.java

package org.elasticsearch.license;

import java.nio.*;
import org.elasticsearch.common.bytes.*;
import java.security.*;
import java.util.*;
import org.elasticsearch.common.xcontent.*;
import org.apache.lucene.util.*;
import org.elasticsearch.core.internal.io.*;
import java.io.*;

public class LicenseVerifier
{
    public static boolean verifyLicense(final License license, final byte[] publicKeyData) {
        return true;
    }
    
    public static boolean verifyLicense(final License license) {
        return true;
    }
}

XPackBuild.java

package org.elasticsearch.xpack.core;

import org.elasticsearch.common.io.*;
import java.net.*;
import org.elasticsearch.common.*;
import java.nio.file.*;
import java.io.*;
import java.util.jar.*;

public class XPackBuild
{
    public static final XPackBuild CURRENT;
    private String shortHash;
    private String date;
    
    @SuppressForbidden(reason = "looks up path of xpack.jar directly")
    static Path getElasticsearchCodebase() {
        final URL url = XPackBuild.class.getProtectionDomain().getCodeSource().getLocation();
        try {
            return PathUtils.get(url.toURI());
        }
        catch (URISyntaxException bogus) {
            throw new RuntimeException(bogus);
        }
    }
    
    XPackBuild(final String shortHash, final String date) {
        this.shortHash = shortHash;
        this.date = date;
    }
    
    public String shortHash() {
        return this.shortHash;
    }
    
    public String date() {
        return this.date;
    }
    
    static {
        final Path path = getElasticsearchCodebase();
        String shortHash = null;
        String date = null;
        Label_0109: {
            shortHash = "Unknown";
            date = "Unknown";
        }
        CURRENT = new XPackBuild(shortHash, date);
    }
}

2、编译并替换jar包

# 将附件在容器中编译
/usr/share/elasticsearch/jdk/bin/javac -cp "/usr/share/elasticsearch/lib/*:/usr/share/elasticsearch/modules/x-pack-core/*" /tmp/LicenseVerifier.java
/usr/share/elasticsearch/jdk/bin/javac -cp "/usr/share/elasticsearch/lib/*:/usr/share/elasticsearch/modules/x-pack-core/*" /tmp/XPackBuild.java

cd /usr/share/elasticsearch/modules/x-pack-core/
cp x-pack-core-7.6.0.jar x-pack-core-7.6.0.jar.bk

# 解压出需要修改的文件
jar xf x-pack-core-7.6.0.jar org/elasticsearch/license/LicenseVerifier.class
jar xf x-pack-core-7.6.0.jar org/elasticsearch/xpack/core/XPackBuild.class

# 替换
mv /tmp/LicenseVerifier.class org/elasticsearch/license/LicenseVerifier.class
mv /tmp/XPackBuild.class org/elasticsearch/xpack/core/XPackBuild.class

# 更新jar包
jar uf x-pack-core-7.6.0.jar org/elasticsearch/license/LicenseVerifier.class
jar uf x-pack-core-7.6.0.jar org/elasticsearch/xpack/core/XPackBuild.class

3、申请License并加载

elastic官网申请一个license, License申请地址，申请完成后，下载下来的License格式为json格式。并将该License的type、expiry_date_in_millis、max_nodes分别修改成platinum、4544447920099、9999。如下：

{"license":
    {
        "uid":"537c5c48-c1dd-43ea-ab69-68d209d80c32",
        "type":"platinum",
        "issue_date_in_millis":1558051200000,
        "expiry_date_in_millis":4544447920099,
        "max_nodes":9999,
        "issued_to":"work",
        "issuer":"Web Form",                                     "signature":"AAAAAwAAAA3fIq7NLN3Blk2olVjbAAABmC9ZN0hjZDBGYnVyRXpCOW5Bb3FjZDAxOWpSbTVoMVZwUzRxVk1PSmkxaktJRVl5MUYvUWh3bHZVUTllbXNPbzBUemtnbWpBbmlWRmRZb25KNFlBR2x0TXc2K2p1Y1VtMG1UQU9TRGZVSGRwaEJGUjE3bXd3LzRqZ05iLzRteWFNekdxRGpIYlFwYkJiNUs0U1hTVlJKNVlXekMrSlVUdFIvV0FNeWdOYnlESDc3MWhlY3hSQmdKSjJ2ZTcvYlBFOHhPQlV3ZHdDQ0tHcG5uOElCaDJ4K1hob29xSG85N0kvTWV3THhlQk9NL01VMFRjNDZpZEVXeUtUMXIyMlIveFpJUkk2WUdveEZaME9XWitGUi9WNTZVQW1FMG1DenhZU0ZmeXlZakVEMjZFT2NvOWxpZGlqVmlHNC8rWVVUYzMwRGVySHpIdURzKzFiRDl4TmM1TUp2VTBOUlJZUlAyV0ZVL2kvVk10L0NsbXNFYVZwT3NSU082dFNNa2prQ0ZsclZ4NTltbU1CVE5lR09Bck93V2J1Y3c9PQAAAQCjNd8mwy8B1sm9rGrgTmN2Gjm/lxqfnTEpTc+HOEmAgwQ7Q1Ye/FSGVNIU/enZ5cqSzWS2mY8oZ7FM/7UPKVQ4hkarWn2qye964MW+cux54h7dqxlSB19fG0ZJOJZxxwVxxi8iyJPUSQBa+QN8m7TFkK2kVmP+HnhU7mGUrqXt3zTk5d3pZw3QBQ/Rr3wmSYC5pxV6/o2UHFgu1OPDcX+kEb+UZtMrVNneR+cEwyx7o5Bg3rbKC014T+lMtt69Y080JDI5KfHa7e9Ul0c3rozIL975fP45dU175D4PKZy98cvHJgtsCJF3K8XUZKo2lOcbsWzhK2mZ5kFp0BMXF3Hs",
        "start_date_in_millis":1558051200000
    }
}

完成以上所有操作在启动elasticsearch前，我们需要配置elasticsearch的SSL/TLS安全协议,如果不配置的话，需要禁止security才能配置License。当License配置完成后我们需要再开启security，并开启SSL\TLS。

cd /usr/share/elasticsearch/config
echo "xpack.security.enabled: false" >> elasticsearch.yml
echo "node.name: node-1" >> elasticsearch.yml
echo 'cluster.initial_master_nodes: ["node-1"]'  >> elasticsearch.yml
echo "vm.max_map_count = 262144" >> /etc/sysctl.conf; sysctl -p

# 加载License到elasticsearch
curl -XPUT -u elastic 'http://127.0.0.1:9200/_xpack/license' -H "Content-Type: application/json" -d @license.json
Enter host password for user 'elastic':           # 提示输入elastic用户密码，当前无密码，所以直接回车
{"acknowledged":true,"license_status":"valid"}    # license写入成功

# 加载License到elasticsearch之后操作
echo "xpack.security.transport.ssl.enabled: true" >> elasticsearch.yml
sed -i 's/xpack.security.enabled: false/xpack.security.enabled: true/g' elasticsearch.yml

# 重启elasticsearch
docker restart es

查看License

$ curl -XGET -u elastic:tWbWZc7NE3wYqS6DvSu4 http://127.0.0.1:9200/_license
{"license":
    {
        "uid":"537c5c48-c1dd-43ea-ab69-68d209d80c32",
        "type":"platinum",
        "issue_date_in_millis":1558051200000,
        "expiry_date_in_millis":4544447920099,
        "max_nodes":9999,
        "issued_to":"work",
        "issuer":"Web Form",
        "start_date_in_millis":1558051200000
    }
}

四、ES与LDAP的认证

1、编辑elasticsearch.yml

[root@7fd26185d286 config]# cat elasticsearch.yml 
cluster.name: "docker-cluster"
network.host: 0.0.0.0
node.name: node1
cluster.initial_master_nodes: ["node1"]

xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: elastic-certificates.p12

xpack:
  security:
    authc:
      realms:
        ldap:
          ldap1:
            order: 0
            url: "ldap://ip:389"
            bind_dn: "cn=root,dc=test,dc=com"
            user_search:
              base_dn: "dc=test,dc=com"
              filter: "(cn={0})"
            group_search:
              base_dn: "dc=test,dc=com"
            files:
              role_mapping: "/usr/share/elasticsearch/config/role_mapping.yml"
            unmapped_groups_as_roles: false

[root@7fd26185d286 config]# 

2、给用户授权

docker exec -it es bash

# 生成ca和证书
bin/elasticsearch-certutil ca
bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12
# 配置本地初始密码
bin/elasticsearch-setup-passwords interactive


# 在容器中使用，添加LDAP的密码
bin/elasticsearch-keystore add \
xpack.security.authc.realms.ldap.ldap1.secure_bind_password

# 映射ldap用户组权限
curl -X PUT -u elastic:密码 "localhost:9200/_security/role_mapping/admins?pretty" -H 'Content-Type: application/json' -d'
{
  "roles" : [ "kibana_admin", "superuser" ],
  "rules" : { "field" : {
    "groups" : "*,ou=rbac,dc=test,dc=com" 
  } },
  "enabled": true
}
'

五、修改Kibana的配置

截止到目前Elasticsearch的部分已经修改完毕，下面修改kibana配置以便于让其和Elasticsearch完成连接。

修改配置文件

修改kibana的配置文件config/kibana.yml在配置文件中添加下面内容，并重启kibana。

elasticsearch.username: "elastic"
elasticsearch.password: "密码"

此时访问kibana（http://ip:5601）会提示需要输入账号密码。此时输入LDAP的用户密码即可登陆。

如果需要对LDAP用户组映射权限修改，可在Kibana界面中 Management - Role Mappings 进行配置。