ES集群设置密码

在es的bin目录下执行./elasticsearch-certutil ca生成elastic-stack-ca.p12

[root@localhost elasticsearch-7.6.0]# cd bin/
[root@localhost bin]# ls
elasticsearch           elasticsearch-cli            elasticsearch-keystore  elasticsearch-saml-metadata    elasticsearch-sql-cli-7.6.0.jar  x-pack-security-env
elasticsearchbak        elasticsearch-croneval       elasticsearch-migrate   elasticsearch-setup-passwords  elasticsearch-syskeygen          x-pack-watcher-env
elasticsearch-certgen   elasticsearch-env            elasticsearch-node      elasticsearch-shard            elasticsearch-users
elasticsearch-certutil  elasticsearch-env-from-file  elasticsearch-plugin    elasticsearch-sql-cli          x-pack-env
[root@localhost bin]# ./elasticsearch-certutil ca

1
2
3
4
5
6
7

Please enter the desired output file [elastic-stack-ca.p12]: elastic-stack-ca.p12
Enter password for elastic-stack-ca.p12 :

1
2

生成 elastic-stack-ca.p12后，执行命令elasticsearch-certutil，注意elastic-stack-ca.p12文件必须是完整路径，否则报错

[root@localhost bin]# ./elasticsearch-certutil cert --ca /home/smartmining/elasticsearch-7.6.0/elastic-stack-ca.p12

Enter password for CA (/home/elasticsearch/elastic-stack-ca.p12) : 
Please enter the desired output file [elastic-certificates.p12]: elastic-certificates.p12
Enter password for elastic-certificates.p12 :   #这里可以不用输入密码，直接按回车键
Certificates written to /home/elasticsearch/elastic-certificates.p12

1
2
3
4
5
6

生成的elastic-certificates.p12文件拷贝到每个节点的config目录下
修改配置elasticsearch.yml elasticsearch.yml配置文件中增加下列配置

xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: elastic-certificates.p12

1
2
3
4
5

配置密码 ./elasticsearch-setup-passwords interactive

验证：浏览器访问弹出要求输入账号密码框

← ElasticSearch常用操作命令 Elasticsearch备份脚本→