반응형
Fleet Server 호스트 추가
다이어그램(diagram)
Elasticsearch에서 보안 및 API 키 인증 기능을 활성화
elasticsearch 구성 파일 편집
- xpack.security.authc.api_key.enabled: true 추가
vim /etc/elasticsearch/elasticsearch.yml...
# Enable security features
xpack.security.enabled: true
xpack.security.enrollment.enabled: true
xpack.security.authc.api_key.enabled: true
# Enable encryption for HTTP API client connections, such as Kibana, Logstash, and Agents
xpack.security.http.ssl:
enabled: true
keystore.path: certs/http.p12
# Enable encryption and mutual authentication between cluster nodes
xpack.security.transport.ssl:
enabled: true
verification_mode: certificate
keystore.path: certs/transport.p12
truststore.path: certs/transport.p12
...systemctl restart elasticsearch.serviceKibana에서 보안 기능을 활성화하고 암호화 키를 설정
Kibana Encryption Key 생성
/usr/share/kibana/bin/kibana-encryption-keys generate$ /usr/share/kibana/bin/kibana-encryption-keys generate
## Kibana Encryption Key Generation Utility
The 'generate' command guides you through the process of setting encryption keys for:
xpack.encryptedSavedObjects.encryptionKey
Used to encrypt stored objects such as dashboards and visualizations
https://www.elastic.co/guide/en/kibana/current/xpack-security-secure-saved-objects.html#xpack-security-secure-saved-objects
xpack.reporting.encryptionKey
Used to encrypt saved reports
https://www.elastic.co/guide/en/kibana/current/reporting-settings-kb.html#general-reporting-settings
xpack.security.encryptionKey
Used to encrypt session information
https://www.elastic.co/guide/en/kibana/current/security-settings-kb.html#security-session-and-cookie-settings
Already defined settings are ignored and can be regenerated using the --force flag. Check the documentation links for instructions on how to rotate encryption keys.
Definitions should be set in the kibana.yml used configure Kibana.
Settings:
xpack.encryptedSavedObjects.encryptionKey: f36c177625d38aa6b144b3d4f5c29059
xpack.reporting.encryptionKey: 4445ce40b2fbfb52befe75831f67d75c
xpack.security.encryptionKey: e5443ff52618ac2fba80c18b1e7f6f9fkibana 구성 파일 편집
- xpack.fleet.agents.tlsCheckDisabled: true
- xpack.encryptedSavedObjects.encryptionKey: f36c177625d38aa6b144b3d4f5c29059
- xpack.reporting.encryptionKey: 4445ce40b2fbfb52befe75831f67d75c
- xpack.security.encryptionKey: e5443ff52618ac2fba80c18b1e7f6f9f
vim /etc/kibana/kibana.yml...
xpack.fleet.agents.tlsCheckDisabled: true
xpack.encryptedSavedObjects.encryptionKey: f36c177625d38aa6b144b3d4f5c29059
xpack.reporting.encryptionKey: 4445ce40b2fbfb52befe75831f67d75c
xpack.security.encryptionKey: e5443ff52618ac2fba80c18b1e7f6f9f
...systemctl restart kibana.service보안 certificates 및 keys ↓↓↓↓↓
더보기
보안 certificates 및 keys
- http_ca.crt : 이 Elasticsearch 클러스터의 HTTP 계층에 대한 인증서를 서명하는 데 사용되는 CA 인증서입니다.
- http.p12 : 이 노드의 HTTP 계층에 대한 키와 인증서가 들어 있는 키 저장소입니다.
- transport.p12 : 클러스터의 모든 노드에 대한 전송 계층의 키와 인증서가 들어 있는 키 저장소입니다.
http.p12 비밀번호 확인
/usr/share/elasticsearch/bin/elasticsearch-keystore show xpack.security.http.ssl.keystore.secure_password$ /usr/share/elasticsearch/bin/elasticsearch-keystore show xpack.security.http.ssl.keystore.secure_password
buzsdW_wR2KpqgoI4I3-PQtransport.p12 비밀번호 확인
/usr/share/elasticsearch/bin/elasticsearch-keystore show xpack.security.transport.ssl.keystore.secure_password$ /usr/share/elasticsearch/bin/elasticsearch-keystore show xpack.security.transport.ssl.keystore.secure_password
Y2BTQ4HRTOiqgrlcO1gxyA
Fleet 서버에 대한 사용자 지정 인증서(certificate) 및 개인 키(private key)를 생성 ↓↓↓↓↓
더보기
Fleet 서버에 대한 사용자 지정 인증서(certificate) 및 개인 키(private key)를 생성
- 인증 기관(CA)을 생성
/usr/share/elasticsearch/bin/elasticsearch-certutil ca --pem$ /usr/share/elasticsearch/bin/elasticsearch-certutil ca --pem
This tool assists you in the generation of X.509 certificates and certificate
signing requests for use with SSL/TLS in the Elastic stack.
The 'ca' mode generates a new 'certificate authority'
This will create a new X.509 certificate and private key that can be used
to sign certificate when running in 'cert' mode.
Use the 'ca-dn' option if you wish to configure the 'distinguished name'
of the certificate authority
By default the 'ca' mode produces a single PKCS#12 output file which holds:
* The CA certificate
* The CA's private key
If you elect to generate PEM format certificates (the -pem option), then the output will
be a zip file containing individual files for the CA certificate and private key
Please enter the desired output file [elastic-stack-ca.zip]:$ ls -l /usr/share/elasticsearch/elastic-stack-ca.zip
-rw------- 1 root root 2516 Mar 17 08:46 /usr/share/elasticsearch/elastic-stack-ca.zipcd /usr/share/elasticsearchunzip elastic-stack-ca.zip$ ls -l ca/
total 8
-rw-r--r-- 1 root root 1200 Mar 17 08:46 ca.crt
-rw-r--r-- 1 root root 1675 Mar 17 08:46 ca.key
- 인증 기관(certificate authority)을 사용하여 Fleet Server용 인증서(certificates) 생성
/usr/share/elasticsearch/bin/elasticsearch-certutil cert \
--name fleet-server \
--ca-cert /usr/share/elasticsearch/ca/ca.crt \
--ca-key /usr/share/elasticsearch/ca/ca.key \
--dns fserver.scbyun.com \
--ip 10.10.10.11 \
--pem$ /usr/share/elasticsearch/bin/elasticsearch-certutil cert \
> --name fleet-server \
> --ca-cert /usr/share/elasticsearch/ca/ca.crt \
> --ca-key /usr/share/elasticsearch/ca/ca.key \
> --dns fserver.scbyun.com \
> --ip 10.10.10.11 \
> --pem
This tool assists you in the generation of X.509 certificates and certificate
signing requests for use with SSL/TLS in the Elastic stack.
The 'cert' mode generates X.509 certificate and private keys.
* By default, this generates a single certificate and key for use
on a single instance.
* The '-multiple' option will prompt you to enter details for multiple
instances and will generate a certificate and key for each one
* The '-in' option allows for the certificate generation to be automated by describing
the details of each instance in a YAML file
* An instance is any piece of the Elastic Stack that requires an SSL certificate.
Depending on your configuration, Elasticsearch, Logstash, Kibana, and Beats
may all require a certificate and private key.
* The minimum required value for each instance is a name. This can simply be the
hostname, which will be used as the Common Name of the certificate. A full
distinguished name may also be used.
* A filename value may be required for each instance. This is necessary when the
name would result in an invalid file or directory name. The name provided here
is used as the directory name (within the zip) and the prefix for the key and
certificate files. The filename is required if you are prompted and the name
is not displayed in the prompt.
* IP addresses and DNS names are optional. Multiple values can be specified as a
comma separated string. If no IP addresses or DNS names are provided, you may
disable hostname verification in your SSL configuration.
* All certificates generated by this tool will be signed by a certificate authority (CA)
unless the --self-signed command line option is specified.
The tool can automatically generate a new CA for you, or you can provide your own with
the --ca or --ca-cert command line options.
By default the 'cert' mode produces a single PKCS#12 output file which holds:
* The instance certificate
* The private key for the instance certificate
* The CA certificate
If you specify any of the following options:
* -pem (PEM formatted output)
* -multiple (generate multiple certificates)
* -in (generate certificates from an input file)
then the output will be be a zip file containing individual certificate/key files
Please enter the desired output file [certificate-bundle.zip]:
Certificates written to /usr/share/elasticsearch/certificate-bundle.zip
This file should be properly secured as it contains the private key for
your instance.
After unzipping the file, there will be a directory for each instance.
Each instance has a certificate and private key.
For each Elastic product that you wish to configure, you should copy
the certificate, key, and CA certificate to the relevant configuration directory
and then follow the SSL configuration instructions in the product guide.
For client applications, you may only need to copy the CA certificate and
configure the client to trust this certificate.$ ls -l /usr/share/elasticsearch/certificate-bundle.zip
-rw------- 1 root root 2651 Mar 17 08:49 /usr/share/elasticsearch/certificate-bundle.zipunzip certificate-bundle.zip$ ls -l fleet-server/
total 8
-rw-r--r-- 1 root root 1216 Mar 17 08:49 fleet-server.crt
-rw-r--r-- 1 root root 1675 Mar 17 08:49 fleet-server.key
Fleet 초기 설정(fleet-server)
Management > Fleet > Add Fleet Server
fleet-server
curl -sL -O https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-8.6.2-linux-x86_64.tar.gztar xzf elastic-agent-8.6.2-linux-x86_64.tar.gzcd elastic-agent-8.6.2-linux-x86_64sudo ./elastic-agent install \
--fleet-server-es=https://192.168.0.61:9200 \
--fleet-server-service-token=AAEAAWVsYXN0aWMvZmxlZXQtc2VydmVyL3Rva2VuLTE2NzkwNjQwNDIyNTY6VXo3ZmN0T1JScWVSbW9STkNsX2F4dw \
--fleet-server-policy=fleet-server-policy \
--fleet-server-es-ca-trusted-fingerprint=7cc403691962d363a2ed7e2da63835fb9d9abec4fd7e25fa88f7824e454e4aca$ sudo ./elastic-agent install \
--fleet-server-es=https://192.168.0.61:9200 \
--fleet-server-service-token=AAEAAWVsYXN0aWMvZmxlZXQtc2VydmVyL3Rva2VuLTE2NzkwNjQwNDIyNTY6VXo3ZmN0T1JScWVSbW9STkNsX2F4dw \
--fleet-server-policy=fleet-server-policy \
--fleet-server-es-ca-trusted-fingerprint=7cc403691962d363a2ed7e2da63835fb9d9abec4fd7e25fa88f7824e454e4aca
Elastic Agent will be installed at /opt/Elastic/Agent and will run as a service. Do you want to continue? [Y/n]:Y
{"log.level":"info","@timestamp":"2023-03-17T23:44:50.023+0900","log.origin":{"file.name":"cmd/enroll_cmd.go","file.line":407},"message":"Generating self-signed certificate for Fleet Server","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2023-03-17T23:44:52.827+0900","log.origin":{"file.name":"cmd/enroll_cmd.go","file.line":803},"message":"Fleet Server - Starting","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2023-03-17T23:44:56.833+0900","log.origin":{"file.name":"cmd/enroll_cmd.go","file.line":784},"message":"Fleet Server - Running on policy with Fleet Server integration: fleet-server-policy; missing config fleet.agent.id (expected during bootstrap process)","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2023-03-17T23:44:57.663+0900","log.origin":{"file.name":"cmd/enroll_cmd.go","file.line":475},"message":"Starting enrollment to URL: https://node1:8220/","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2023-03-17T23:44:59.217+0900","log.origin":{"file.name":"cmd/enroll_cmd.go","file.line":273},"message":"Successfully triggered restart on running Elastic Agent.","ecs.version":"1.6.0"}
Successfully enrolled the Elastic Agent.
Elastic Agent has been successfully installed.
Management > Fleet
elastic-agent
Management > Fleet > Add agent
elastic-agent ↓↓↓↓↓
더보기
curl -sL -O https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-8.6.2-linux-x86_64.tar.gztar xzf elastic-agent-8.6.2-linux-x86_64.tar.gzcd elastic-agent-8.6.2-linux-x86_64sudo ./elastic-agent install --url=https://192.168.0.61:8220 --enrollment-token=Umk0WThJWUJpTXItaXBna05nOUo6RnBQSlY5Z1VUa2U5QnNZLVRmUkhSUQ==
elastic-agent docker-compose file
vim docker-compose.yamlversion: '3.9'
services:
elastic-agent:
image: docker.elastic.co/beats/elastic-agent:8.6.2
container_name: elastic-agent
restart: always
user: root
ulimits:
nofile:
soft: 65536
hard: 65536
environment:
- FLEET_ENROLL=1
- FLEET_URL=https://192.168.0.61:8220
- FLEET_ENROLLMENT_TOKEN=Umk0WThJWUJpTXItaXBna05nOUo6RnBQSlY5Z1VUa2U5QnNZLVRmUkhSUQ==
- FLEET_INSECURE=true
volumes:
- /usr/share/zoneinfo/Asia/Seoul:/etc/localtime:ro
command: agent
networks:
- default
logging:
driver: "json-file"
options:
max-size: "100m"
max-file: "10"docker-compose up -d
Management > Fleet
참고URL
- Deploy on-premises and self-managed : https://www.elastic.co/guide/en/fleet/8.6/add-fleet-server-on-prem.html#add-fleet-server-on-prem-compatibility
728x90
반응형
'리눅스' 카테고리의 다른 글
| ABRT(Automated Bug Reporting Tool)에 의한 문제(problem)를 감지 (0) | 2023.03.20 |
|---|---|
| find 명령어 (0) | 2023.03.20 |
| PHP의 설정 파일인 php.ini 파일의 위치를 찾는 방법 (0) | 2023.03.17 |
| [리눅스] Elasticsearch와 Kibana를 설치하고 연동하는 방법(single node) (0) | 2023.03.17 |
| Nginx에서 X-Forwarded-For(XFF) 설정하는 방법 (0) | 2023.03.15 |
