https://www.elastic.co/guide/en/shield/shield-1.3/introduction.html

 一、简介

Shield是Elasticsearch的一个插件，它能够很容易的保证你的Elasticsearch集群的安全性。

Shield的功能：

1.用户认证

2.SSL/TLS的加密身份验证

3.审计

二、安装

我使用的shield-1.3的版本

1. 安装Elasticsearch集群

2. Shield是需要licese的，我们只有在offline机器上安装使用

a.下载license https://download.elastic.co/elasticsearch/license/license-latest.zip

[root@hftclclw0001 usr]# pwd
/usr[root@hftclclw0001 usr]# wget https://download.elastic.co/elasticsearch/license/license-latest.zip
...
...

b. 下载 shield https://download.elastic.co/elasticsearch/shield/shield-latest.zip

[root@hftclclw0001 usr]# pwd
/usr[root@hftclclw0001 usr]# wget https://download.elastic.co/elasticsearch/shield/shield-latest.zip
...
...

c. 安装license 和 shield

注意/usr/share/elasticsearch/  是elasticsearch的安装目录是本地文件的协议前缀 [root@hftclclw0001 usr]# /usr/share/elasticsearch/bin/plugin -i license -u file:///usr/license-latest.zip
...
...[root@hftclclw0001 usr]# /usr/share/elasticsearch/bin/plugin -i license -u file:///usr/shield-latest.zip
...
...校验：
[root@hftclclw0001 usr]#  ll /usr/share/elasticsearch/plugins/
...
...
license
shield
...[root@hftclclw0001 usr]# curl -XGET '    => 此时是无法访问的，需要身份验证
... 首先创建一个管理员
[root@hftclclw0001 plugins]# /usr/share/elasticsearch/bin/shield/esusers useradd es_admin -r admin
...[root@hftclclw0001 usr]# curl -XGET -u es_admin:{passwd} 'http://{ip}:9200/'

三、消息认证(enable message authentication)

https://www.elastic.co/guide/en/shield/shield-1.3/enable-message-authentication.html

消息验证会验证消息传输过程中是否被篡改等

1.生成key
[root@hftclclw0001 shield]# /usr/share/elasticsearch/bin/shield/syskeygen
...会生成 ES_HOME/config/shield/system_key然后再elasticsearch.yml 中配置
shield.system_key.file=2.复制key到其他各个节点上，各个节点必须相同

四、用户认证配置(setting up user authentication)

为了获取受限资源权限，用户必须提供身份校验信息。如密码等。

1.esusers

是shield内置一种方式

https://www.elastic.co/guide/en/shield/shield-1.3/esusers.html

https://www.elastic.co/guide/en/shield/shield-1.3/_managing_users_in_an_esusers_realm.html

添加用户(Adding User)
[root@hftclclw0001 plugins]# /usr/share/elasticsearch/bin/shield/esusers useradd test_1
会提示让你输入密码，[root@hftclclw0001 plugins]# /usr/share/elasticsearch/bin/shield/esusers  useradd test-1 -p test_1
这样就会创建一个用户test_1 密码是 test_1[root@hftclclw0001 plugins]# /usr/share/elasticsearch/bin/shield/esusers list
#【userid】: 【roleid】
...
test_1         : -
...默认角色是 -  也没有啥权限，稍后会说明角色与权限修改用户密码(Managing User Passwords)
[root@hftclclw0001 plugins]# /usr/share/elasticsearch/bin/shield/esusers passwd test-1 -p test_1

2. 基于角色的访问控制

https://www.elastic.co/guide/en/shield/shield-1.3/configuring-rbac.html

定义角色(Defining Roles)
roles.yml[root@hftclclw0001 shield]# pwd
/etc/elasticsearch/shield
[root@hftclclw0001 shield]# ll
total 36
-rwxr-xr-x 1 elasticsearch elasticsearch 1119 Nov  9 05:21 logging.yml
-rw------- 1 elasticsearch elasticsearch 1119 Nov  9 06:28 logging.yml.new
-rwxr-xr-x 1 elasticsearch elasticsearch  473 Nov  9 05:21 role_mapping.yml
-rw------- 1 elasticsearch elasticsearch  473 Nov  9 06:28 role_mapping.yml.new
-rwxr-xr-x 1 elasticsearch elasticsearch 2634 Nov 12 09:06 roles.yml            => 角色与权限的映射
-rw------- 1 elasticsearch elasticsearch 2699 Nov  9 06:28 roles.yml.new
-rw------- 1 elasticsearch elasticsearch  128 Nov 12 08:24 system_key.new
-rwxr-xr-x 1 elasticsearch elasticsearch  410 Nov 12 09:02 users                => 用户信息
-rw------- 1 elasticsearch elasticsearch    0 Nov  9 06:28 users.new
-rwxr-xr-x 1 elasticsearch elasticsearch   85 Nov 12 09:02 users_roles          => 用户与角色的映射
-rw------- 1 elasticsearch elasticsearch    0 Nov  9 06:28 users_roles.new
[root@hftclclw0001 shield]# 默认的角色有：
admin
power_user
user
...

eg1: 我们创建一个用户test_logstash 它只能访问 logstash-* 的indices1.创建角色
[root@hftclclw0001 shield]# vi /etc/elasticsearch/shield/roles.yml
...
...
logstash_user:cluster: allindices:'logstash-*': indices:data/read/search, indices:data/read/get, indices:admin/get   => 读权限
...
...2.创建用户并执行角色
[root@hftclclw0001 shield]# /usr/share/elasticsearch/bin/shield/esusers useradd test_logstash -p test_logstash -r logstash_user
...
...3. WEB UI 或 Terminate上校验，是否能访问logstash-*索引，是否能访问写，是否能访问其他的

3. LDAP 验证

4.