Hello, everyone. Today I'm going to show you how to get started with Security
using the Elastic Stack. We're going to create a 2 node Elasticsearch cluster
configure TLS communication between the nodes, and have a Kibana instance talking
to them to analyze the data. As you can see here, I've already downloaded the
Elasticsearch and Kibana tarballs as part of our 7.1 distribution. I've
extracted both archives. The one other thing I did was copy the Elasticsearch
directory twice, one named "Master" one named "Node" as this will be a two node cluster.
Let's CD into the master directory. Now I'm going to switch over to the
tab with the text file I put together that has all of the commands we'll run and the
configuration settings to make everything work. Don't worry about trying
to write all this down. We'll have a link to a blog post where you can find
everything later. The first thing we have to do is generate some certificates that
allow the nodes to communicate securely. We have a command here called
"Elasticsearch-certutils" you can run to do this without any of the usual
certificate confusion. We'll just paste the command in the master node directory.
When it asks us for a file name let's put it in the configuration directory
since that's where Elasticsearch will look for it. Once that's done we can copy
the Elasticsearch configuration file changes we need to enable security and
configure TLS.
Now we open up the Elasticsearch YAML file. Jump to the bottom and paste the
configuration changes. Save the file and we're ready to start
the master node. Once the node is running it's time to
set the passwords for the cluster. In a new terminal we CD into the master node
directory.
Then we run the Elasticsearch setup passwords command with the auto option.
This will generate random passwords for the various internal stack users.
Now let's switch to our node tab and get that configured.
The easiest thing we can do is just to copy everything from the master's
configuration directory into the node's configuration directory.
Then we start the node. We'll see it join the cluster.
And if we switch over to the master node, we can see a message there that a node
has joined the cluster. Now we have a 2 node cluster running. The next thing
we'll need to do is configure Kibana. We'll need to add the password for the
Kibana user. We can grab that from our passwords terminal. Let's CD into the
Kibana directory, edit the Kibana YAML file -- that's generally easiest to just
search for passwords to find where we have to edit the configuration.
First we have to uncomment the username and password fields, then we set the
username to Kibana and the password is whatever we copied from the password's
window.
Save the file and we can start Kibana. Once Kibana is running we can switch over
to our web browser and log in to local host and port 5601
It's going to ask us for a login and we'll use the Elastic super user to
configure our new roles and users.
Kibana will ask us if we want to load some sample data when it's a new install
such as this. Let's load the flight and web sample data for the sake of this
example.
Once those are loaded, let's check to make sure we have a 2 node cluster we
click the dev tool icon and click the cluster health.
We can see there are 2 nodes, which is what we expected. Now let's create our
roles. Click the configuration icon and find
the roles option at the bottom. We're going to name the first role "Read Logs."
Scroll down to the index privileges field and select the log index then give
it the read privilege.
The section about spaces is something you'll probably want to investigate once
you have security working, but for this particular demo we're going to skip it.
Now let's create another role called "Read flight."
We assign the flight index the read privilege
and now we're going to create two users to assign these roles to. We'll name the
first user "Flight User."
Set the password -- we can ignore full name and email address -- we need to assign our
read flight role,
and we also need to assign the Kibana user role as this user will be viewing
data in Kibana. Hit create and let's do it again for the log user.
This time we add the read logs role in Kibana user.
Okay, we're all set with two new users.
Let's log out as the Elastic user and log back in as the Log user
If we click on the dashboards icon, we can see there are two dashboards, one for
flights and one for logs. Let's check logs first. And here we can
see our demo log data. Now if we try to view the flights dashboard we can see
the dashboard, but we can't see any of the data
This is a place Kibana Spaces can be used to only allow certain users to see
certain dashboards, so now let's log out and log back in with the Flights user.
If we open the Log dashboard, this time we can't see any data. We even get an
error because Kibana can't access the log index. Now when we check the Flight
dashboard we can see we have access to the flight data this time.
Congratulations! We now have a 2 node cluster configured in 2 users with
restricted access to index data. We have extensive documentation and blog post on
how Elastic Stack security works and what else you can accomplish with it. Go
check it out. Happy searching, everybody!