I've been going through the documentation for setting up authentication with LDAP but I must be missing something because after adding my changes to the file /etc/elasticsearch/elasticsearch.yml the service refuses to start and if I go to kibana I'm met with:
Login is currently disabled. Administrators should consult the Kibana logs for more details.
This is what my /etc/elasticsearch/elasticsearch.yml file contains:
cluster.name: elasticsearch
node.name: default-amazon
path.data: "/var/lib/elasticsearch"
path.logs: "/var/log/elasticsearch"
xpack.security.authc.realms:
ldap1:
type: ldap
order: 0
url: "ldaps://openldap.mysweetdomain.com:636"
bind_dn: "cn=admin,dc=mysweetdomain,dc=com"
user_search:
base_dn: "dc=mysweetdomain,dc=com"
group_search:
base_dn: "dc=mysweetdomain,dc=com"
files:
role_mapping: "CONFIG_DIR/role_mapping.yml"
unmapped_groups_as_roles: false
ssl.verification_mode: none
I have a valid certificate but for the sake of testing, I've asked this configuration not to validate it. If I remove the xpack configuration all together it starts up fine and kibana will display but then I have no authentication/authorization in place.
Right now starting up the service results in the following
[root@ip-10-0-0-40 elasticsearch]# service elasticsearch start
Starting elasticsearch (via systemctl): [ OK ]
[root@ip-10-0-0-40 elasticsearch]# service elasticsearch status
● elasticsearch.service - Elasticsearch
Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; enabled; vendor preset: disabled)
Active: active (running) since Wed 2018-06-27 19:04:46 UTC; 1s ago
Docs: http://www.elastic.co
Main PID: 16118 (java)
CGroup: /system.slice/elasticsearch.service
‣ 16118 [java]
Jun 27 19:04:47 ip-10-0-0-40.us-east-2.compute.internal elasticsearch[16118]: at org.elasticsearch.bootstrap.Bootstrap.loadSecureSettings(Bootstrap.java:226)
Jun 27 19:04:47 ip-10-0-0-40.us-east-2.compute.internal elasticsearch[16118]: at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:291)
Jun 27 19:04:47 ip-10-0-0-40.us-east-2.compute.internal elasticsearch[16118]: at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:136)
Jun 27 19:04:47 ip-10-0-0-40.us-east-2.compute.internal elasticsearch[16118]: at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:127)
Jun 27 19:04:47 ip-10-0-0-40.us-east-2.compute.internal elasticsearch[16118]: at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86)
Jun 27 19:04:47 ip-10-0-0-40.us-east-2.compute.internal elasticsearch[16118]: at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:124)
Jun 27 19:04:47 ip-10-0-0-40.us-east-2.compute.internal elasticsearch[16118]: at org.elasticsearch.cli.Command.main(Command.java:90)
Jun 27 19:04:47 ip-10-0-0-40.us-east-2.compute.internal elasticsearch[16118]: at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:93)
Jun 27 19:04:47 ip-10-0-0-40.us-east-2.compute.internal elasticsearch[16118]: at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:86)
Jun 27 19:04:47 ip-10-0-0-40.us-east-2.compute.internal elasticsearch[16118]: Refer to the log for complete error details.
[root@ip-10-0-0-40 elasticsearch]# service elasticsearch status
● elasticsearch.service - Elasticsearch
Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; enabled; vendor preset: disabled)
Active: failed (Result: exit-code) since Wed 2018-06-27 19:04:47 UTC; 7s ago
Docs: http://www.elastic.co
Process: 16118 ExecStart=/usr/share/elasticsearch/bin/elasticsearch -p ${PID_DIR}/elasticsearch.pid --quiet (code=exited, status=1/FAILURE)
Main PID: 16118 (code=exited, status=1/FAILURE)
Jun 27 19:04:47 ip-10-0-0-40.us-east-2.compute.internal elasticsearch[16118]: at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:127)
Jun 27 19:04:47 ip-10-0-0-40.us-east-2.compute.internal elasticsearch[16118]: at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86)
Jun 27 19:04:47 ip-10-0-0-40.us-east-2.compute.internal elasticsearch[16118]: at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:124)
Jun 27 19:04:47 ip-10-0-0-40.us-east-2.compute.internal elasticsearch[16118]: at org.elasticsearch.cli.Command.main(Command.java:90)
Jun 27 19:04:47 ip-10-0-0-40.us-east-2.compute.internal elasticsearch[16118]: at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:93)
Jun 27 19:04:47 ip-10-0-0-40.us-east-2.compute.internal elasticsearch[16118]: at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:86)
Jun 27 19:04:47 ip-10-0-0-40.us-east-2.compute.internal elasticsearch[16118]: Refer to the log for complete error details.
Jun 27 19:04:47 ip-10-0-0-40.us-east-2.compute.internal systemd[1]: elasticsearch.service: main process exited, code=exited, status=1/FAILURE
Jun 27 19:04:47 ip-10-0-0-40.us-east-2.compute.internal systemd[1]: Unit elasticsearch.service entered failed state.
Jun 27 19:04:47 ip-10-0-0-40.us-east-2.compute.internal systemd[1]: elasticsearch.service failed.
It only stays alive for a split second for dying. Any help will be appreciated, if need be I can post an example of my OpenLDAP.
LDAP SERVER STATS:
OpenLDAP 2.4.42 running on Ubuntu x64 16.04
ELK Server:
Amazon Linux LTS 2 x64
ELK is version 6.3.0
