Hi everyone,
I'm trying to set up security in ES by following this guide here:
I've hit a roadblock and can't seem to work it out on my own
First issue is due to possibly breaking changes in latest elasticsearch (7.3.0)
Enabling PKI authentication from the guide doesn't work for me
xpack.security.authc.realms.pki1.type: pki
I've changed it to
xpack.security.authc.realms.pki.pki1.order: 1
So up until this point everything is working
Creating a client certificate command however fails
bin/elasticsearch-certutil cert --ca \
config/certs/elastic-stack-ca.p12 \
-name "CN=something,OU=Consulting Team,DC=mydomain,DC=com"
ENTER
client.p12 ENTER
ENTER
The -name basically ends up being the name of the certificate????
/usr/share/elasticsearch/bin/elasticsearch-certutil cert --ca /etc/elasticsearch/certs/elastic-stack-ca.p12 -name "CN=something,OU=Consulting Team,DC=mydomain,DC=com"
This tool assists you in the generation of X.509 certificates and certificate
signing requests for use with SSL/TLS in the Elastic stack.
Enter password for CA (/etc/elasticsearch/certs/elastic-stack-ca.p12) :
Please enter the desired output file [CN=something,OU=Consulting Team,DC=mydomain,DC=com.p12]:
Enter password for CN=something,OU=Consulting Team,DC=mydomain,DC=com.p12 :
Certificates written to /usr/share/elasticsearch/CN=something,OU=Consulting Team,DC=mydomain,DC=com.p12
This file should be properly secured as it contains the private key for
your instance.
This file is a self contained file and can be copied and used 'as is'
For each Elastic product that you wish to configure, you should copy
this '.p12' file to the relevant configuration directory
and then follow the SSL configuration instructions in the product guide.
For client applications, you may only need to copy the CA certificate and
configure the client to trust this certificate.
root@elastic18:/etc/elasticsearch/certs# ls
elastic-certificates.p12 elastic-stack-ca.p12
root@elastic18:/etc/elasticsearch/certs# ls /usr/share/elasticsearch/
bin 'CN=something,OU=Consulting Team,DC=mydomain,DC=com.p12' jdk lib modules NOTICE.txt plugins README.textile
I've tried using something like this instead:
/usr/share/elasticsearch/bin/elasticsearch-certutil cert --ca /etc/elasticsearch/certs/elastic-stack-ca.p12 --name "CN=something,OU=Consulting Team,DC=mydomain,DC=com" --out /etc/elasticsearch/certs/client.p12
I generate the Private Key, Public Certificate and CA Certificate
openssl pkcs12 -in /etc/elasticsearch/certs/client.p12 -nocerts -nodes --out /etc/kibana/certs/client.key
openssl pkcs12 -in /etc/elasticsearch/certs/client.p12 -clcerts -nokeys --out /etc/kibana/certs/client.cer
openssl pkcs12 -in /etc/elasticsearch/certs/client.p12 -cacerts -nokeys -chain --out /etc/kibana/certs/client-ca.cer
I keep following the guide and add the following to kibana.yml
elasticsearch.hosts: ["https://localhost:9200"]
server.host: "localhost"
elasticsearch.username: "kibana"
elasticsearch.password: "pass"
xpack.security.enabled: true
elasticsearch.ssl.certificateAuthorities: /etc/kibana/certs/client-ca.cer
elasticsearch.ssl.verificationMode: certificate
I restart Kibana and receive no errors, but in the next step the curl command fails to authenticate using certificates only
curl https://localhost:9200/_xpack/security/_authenticate?pretty --key client.key --cert client.cer --cacert client-ca.cer -k -v
- Trying ::1...
- TCP_NODELAY set
- Connected to localhost (::1) port 9200 (#0)
- ALPN, offering h2
- ALPN, offering http/1.1
- successfully set certificate verify locations:
- CAfile: client-ca.cer
CApath: /etc/ssl/certs - (304) (OUT), TLS handshake, Client hello (1):
- (304) (IN), TLS handshake, Server hello (2):
- (304) (OUT), TLS change cipher, Client hello (1):
- (304) (OUT), TLS handshake, Client hello (1):
- (304) (IN), TLS handshake, Server hello (2):
- (304) (IN), TLS Unknown, Certificate Status (22):
- (304) (IN), TLS handshake, Unknown (8):
- (304) (IN), TLS handshake, Request CERT (13):
- (304) (IN), TLS handshake, Certificate (11):
- (304) (IN), TLS handshake, CERT verify (15):
- (304) (IN), TLS handshake, Finished (20):
- (304) (OUT), TLS Unknown, Certificate Status (22):
- (304) (OUT), TLS handshake, Certificate (11):
- (304) (OUT), TLS Unknown, Certificate Status (22):
- (304) (OUT), TLS handshake, CERT verify (15):
- (304) (OUT), TLS Unknown, Certificate Status (22):
- (304) (OUT), TLS handshake, Finished (20):
- SSL connection using unknown / TLS_AES_256_GCM_SHA384
- ALPN, server did not agree to a protocol
- Server certificate:
- subject: CN=instance
- start date: Aug 19 01:53:44 2019 GMT
- expire date: Aug 18 01:53:44 2022 GMT
- issuer: CN=Elastic Certificate Tool Autogenerated CA
- SSL certificate verify ok.
- (304) (OUT), TLS Unknown, Unknown (23):
GET /_xpack/security/_authenticate?pretty HTTP/1.1
Host: localhost:9200
User-Agent: curl/7.58.0
Accept: /
- (304) (IN), TLS Unknown, Certificate Status (22):
- (304) (IN), TLS handshake, Newsession Ticket (4):
- (304) (IN), TLS Unknown, Unknown (23):
< HTTP/1.1 401 Unauthorized
< WWW-Authenticate: Bearer realm="security"
< WWW-Authenticate: ApiKey
< WWW-Authenticate: Basic realm="security" charset="UTF-8"
< content-type: application/json; charset=UTF-8
< content-length: 746
<
{
"error" : {
"root_cause" : [
{
"type" : "security_exception",
"reason" : "missing authentication credentials for REST request [/_xpack/security/_authenticate?pretty]",
"header" : {
"WWW-Authenticate" : [
"Bearer realm="security"",
"ApiKey",
"Basic realm="security" charset="UTF-8""
]
}
}
],
"type" : "security_exception",
"reason" : "missing authentication credentials for REST request [/_xpack/security/_authenticate?pretty]",
"header" : {
"WWW-Authenticate" : [
"Bearer realm="security"",
"ApiKey",
"Basic realm="security" charset="UTF-8""
]
}
},
"status" : 401
}- Connection #0 to host localhost left intact
Thanks for your help