elasticSearch设置用户名密码查询

一、设置密码

1.需要在配置文件中开启x-pack验证, 修改config目录下面的elasticsearch.yml文件&＃xff0c;在里面添加如下内容,并重启.

xpack.security.enabled: true
xpack.license.self_generated.type: basic
xpack.security.transport.ssl.enabled: true

2&＃xff0c;执行设置用户名和密码的命令,这里需要为4个用户分别设置密码&＃xff0c;elastic, kibana, logstash_system,beats_system

bin/elasticsearch-setup-passwords interactive


 网上设置时出现的&＃xff1a;

Initiating the setup of passwords for reserved users elastic,kibana,logstash_system,beats_system.
You will be prompted to enter passwords as the process progresses.
Please confirm that you would like to continue [y/N]y
Enter password for [elastic]:
passwords must be at least [6] characters long
Try again.
Enter password for [elastic]:
Reenter password for [elastic]:
Passwords do not match.
Try again.
Enter password for [elastic]:
Reenter password for [elastic]:
Enter password for [kibana]:
Reenter password for [kibana]:
Enter password for [logstash_system]:
Reenter password for [logstash_system]:
Enter password for [beats_system]:
Reenter password for [beats_system]:
Changed password for user [kibana]
Changed password for user [logstash_system]
Changed password for user [beats_system]
Changed password for user [elastic]

 我设置密码时出现的&＃xff1a;

[es&＃64;k8snode2 elasticsearch-7.3.0]$ ./bin/elasticsearch-setup-passwords interactive
Initiating the setup of passwords for reserved users elastic,apm_system,kibana,logstash_system,beats_system,remote_monitoring_user.
You will be prompted to enter passwords as the process progresses.
Please confirm that you would like to continue [y/N]yEnter password for [elastic]:
Reenter password for [elastic]:
Passwords do not match.
Try again.
Enter password for [elastic]:
Reenter password for [elastic]:
Enter password for [apm_system]:
Reenter password for [apm_system]:
Enter password for [kibana]:
Reenter password for [kibana]:
Enter password for [logstash_system]:
Reenter password for [logstash_system]:
Enter password for [beats_system]:
Reenter password for [beats_system]:
Enter password for [remote_monitoring_user]:
Reenter password for [remote_monitoring_user]:
Changed password for user [apm_system]
Changed password for user [kibana]
Changed password for user [logstash_system]
Changed password for user [beats_system]
Changed password for user [remote_monitoring_user]
Changed password for user [elastic]


其中&＃xff0c;用户权限分别如下&＃xff1a;

• elastic 账号&＃xff1a;拥有 superuser 角色&＃xff0c;是内置的超级用户。
• kibana 账号&＃xff1a;拥有 kibana_system 角色&＃xff0c;用户 kibana 用来连接 elasticsearch 并与之通信。Kibana 服务器以该用户身份提交请求以访问集群监视 API 和 .kibana 索引。不能访问 index。
• logstash_system 账号&＃xff1a;拥有 logstash_system 角色。用户 Logstash 在 Elasticsearch 中存储监控信息时使用。

二、修改密码

修改密码命令如下&＃xff1a;

curl -H "Content-Type:application/json" -XPOST -u elastic &＃39;http://127.0.0.1:9200/_xpack/security/user/elastic/_password&＃39; -d &＃39;{ "password" : "123456" }&＃39;

三、带密码查询

Elasticsearch设置用户名密码之后&＃xff0c;不能再直接使用Elasticsearch head 访问&＃xff0c;可以在查询等API上加上用户等参数&＃xff1a;

curl -XGET --user user:passwd &＃39;http://XXXX:9200/XX/XXX&＃39;

比如想要清空某个索引下的数据&＃xff1a;

curl -XPOST --user admin:admin &＃39;http://XXXX:9200/XXXX/XXX/_delete_by_query&＃39; -H "Content-Type: application/json" -d &＃39;{ "query":{"match_all":{}}}&＃39;


四、添加自定义角色

添加角色接口为&＃xff1a;POST /_xpack/security/role/

下面添加一个超级管理员角色为例&＃xff1a;

[elastic&＃64;data-backup elasticsearch-6.2.4]$ curl -XPOST -H &＃39;Content-type: application/json&＃39; -u elastic:elastic123 &＃39;http://10.163.19.231:9600/_xpack/security/role/admin?pretty&＃39; -d &＃39;{
"run_as":["elastic"],
"cluster":["all"],
"indices":[{"names":["*"],"privileges":["all"]}
]
}&＃39;
{"role" : {"created" : true}
}
[elastic&＃64;data-backup elasticsearch-6.2.4]$ curl -XGET -H &＃39;Content-type: application/json&＃39; -u elastic:elastic123 &＃39;http://10.163.19.231:9600/_xpack/security/role/admin?pretty&＃39;
{"admin" : {"cluster" : ["all"],"indices" : [{"names" : ["*"],"privileges" : ["all"]}],"run_as" : ["elastic"],"metadata" : { },"transient_metadata" : {"enabled" : true}}
}

五、添加自定义用户

添加用户接口为&＃xff1a;POST/_xpack/security/user/

下面以添加一个test用户并添加至admin角色为例&＃xff1a;

[elastic&＃64;data-backup elasticsearch-6.2.4]$ curl -XGET -H &＃39;Content-type: application/json&＃39; -u test:Test123654% &＃39;http://10.163.19.231:9600/_cat/indices?pretty&＃39;
green open .monitoring-es-6-2019.09.17 J1K2XG1eTXqw0GHSOH5Gwg 1 0 848 104 846.9kb 846.9kb
green open .watches qHj5owowRC-3DeK8DaLD-g 1 0 6 0 47.8kb 47.8kb
green open .triggered_watches 2pm3BwCnTaKgyzl39eFpUw 1 0 0 0 5.1kb 5.1kb
yellow open monitor yFnfztziSguTq9VsfSANpw 5 1 48 0 226.7kb 226.7kb
green open .watcher-history-7-2019.09.17 uz6RA_8vRraHHLAitWKtAw 1 0 74 0 259.8kb 259.8kb
green open .monitoring-alerts-6 ZPTqnNVOQ5GlUK1ncXNQDQ 1 0 2 0 18.1kb 18.1kb
yellow open track AqSGAZnAQE2NGvZXlp9zcw 5 1 1343729 175384 201mb 201mb
green open .security-6 83fAslPbQDSGbGWfhiMAXA 1 0

注&＃xff1a;这里要注意的是用户密码最好不要有"$" "!"之类的字符&＃xff0c;这样有可能会导致密码认证不成功&＃xff0c;其他字符测试过暂时没问题&＃xff08;具体原因不详&＃xff0c;反正我遇到过这个坑&＃xff09;

六、header带密码插件访问

修改配置文件elasticsearch.yml&＃xff0c;增加
http.cors.allow-headers: Authorization

访问head时&＃xff0c;url如下所示&＃xff1a;
http://192.168.100.100:9100/?auth_user&＃61;elastic&auth_password&＃61;changeme

七、java api带密码访问
 

//初始化ES操作客户端final CredentialsProvider credentialsProvider &＃61; new BasicCredentialsProvider();credentialsProvider.setCredentials(AuthScope.ANY,new UsernamePasswordCredentials("elastic", "123456")); //es账号密码&＃xff08;默认用户名为elastic&＃xff09;RestHighLevelClient esClient &＃61;new RestHighLevelClient(RestClient.builder(new HttpHost("127.0.0.1",9200)).setHttpClientConfigCallback(new RestClientBuilder.HttpClientConfigCallback() {public HttpAsyncClientBuilder customizeHttpClient(HttpAsyncClientBuilder httpClientBuilder) {httpClientBuilder.disableAuthCaching();return httpClientBuilder.setDefaultCredentialsProvider(credentialsProvider);}})/.setMaxRetryTimeoutMillis(2000)/);