closing connection Netty4TcpChannel{localAddress=/xx.xx.xx.xx:9300, remoteAddress=/xx.xx.xx.xx:port, profile=default}
[2022-06-15T11:51:04,468][WARN ][o.e.x.c.s.t.n.SecurityNetty4Transport] [es-master-1] client did not trust this server's certificate, closing connection
You need to share a lot more information than this for anyone to be able to help you out. Describe in detail what you have done so far, what is your configuration, what happens exactly, bigger part of the logs etc.
1 Like
Hi, Sorry for less info, as this is my first post. I want to setup and Elasticsearch cluster with username and password security. I am installing the Elasticsearch version 8.2.3.
I am able to start the Elasticsearch separately in master and data node, but both the node not able to connect to each other as a part of cluster. i am getting the error is authentication is failed or cluster health is red.
Below is my master node Elasticsearch.yml file
======================== Elasticsearch Configuration =========================
NOTE: Elasticsearch comes with reasonable defaults for most settings.
Before you set out to tweak and tune the configuration, make sure you
understand what are you trying to accomplish and the consequences.
The primary way of configuring a node is via this file. This template lists
the most important settings you may want to configure for a production cluster.
Please consult the documentation for further information on configuration options:
Elasticsearch Guide | Elastic
---------------------------------- Cluster -----------------------------------
Use a descriptive name for your cluster:
#cluster.name: my-application
------------------------------------ Node ------------------------------------
Use a descriptive name for the node:
#node.name: node-1
Add custom attributes to the node:
#node.attr.rack: r1
----------------------------------- Paths ------------------------------------
Path to directory where to store the data (separate multiple locations by comma):
#path.data: /var/lib/Elasticsearch
Path to log files:
#path.logs: /var/log/Elasticsearch
----------------------------------- Memory -----------------------------------
Lock the memory on startup:
#bootstrap.memory_lock: true
Make sure that the heap size is set to about half the memory available
on the system and that the owner of the process is allowed to use this
limit.
Elasticsearch performs poorly when the system is swapping the memory.
---------------------------------- Network -----------------------------------
By default Elasticsearch is only accessible on localhost. Set a different
address here to expose this node on the network:
#network.host: 192.168.0.1
By default Elasticsearch listens for HTTP traffic on the first free port it
finds starting at 9200. Set a specific HTTP port here:
#http.port: 9200
For more information, consult the network module documentation.
--------------------------------- Discovery ----------------------------------
Pass an initial list of hosts to perform discovery when this node is started:
The default list of hosts is ["127.0.0.1", "[::1]"]
#discovery.seed_hosts: ["host1", "host2"]
Bootstrap the cluster using an initial set of master-eligible nodes:
#cluster.initial_master_nodes: ["node-1", "node-2"]
For more information, consult the discovery and cluster formation module documentation.
--------------------------------- Readiness ----------------------------------
Enable an unauthenticated TCP readiness endpoint on localhost
#readiness.port: 9399
---------------------------------- Various -----------------------------------
Allow wildcard deletion of indices:
#action.destructive_requires_name: false
#----------------------- BEGIN SECURITY AUTO CONFIGURATION -----------------------
The following settings, TLS certificates, and keys have been automatically
generated to configure Elasticsearch security features on 15-06-2022 10:03:20
--------------------------------------------------------------------------------
Enable security features
xpack.security.enabled: true
xpack.security.enrollment.enabled: true
Enable encryption for HTTP API client connections, such as Kibana, Logstash, and Agents
xpack.security.http.ssl:
enabled: true
keystore.path: certs/http.p12
Enable encryption and mutual authentication between cluster nodes
xpack.security.transport.ssl:
enabled: true
verification_mode: certificate
keystore.path: certs/transport.p12
truststore.path: certs/transport.p12
Create a new cluster with the current node only
Additional nodes can still join the cluster later
cluster.initial_master_nodes: ["es-master-1"]
Allow HTTP API connections from anywhere
Connections are encrypted and require user authentication
http.host: 0.0.0.0
Allow other nodes to join the cluster from anywhere
Connections are encrypted and mutually authenticated
#transport.host: 0.0.0.0
#----------------------- END SECURITY AUTO CONFIGURATION -------------------------
cluster.name: elk-production
node.name: ${HOSTNAME}
node.roles: [master]
path.data: /fs1/Elasticsearch/data
path.logs: /fs1/Elasticsearch/logs
network.host: 0.0.0.0
discovery.seed_hosts: ["es-master-1"]
data node yml:
======================== Elasticsearch Configuration =========================
NOTE: Elasticsearch comes with reasonable defaults for most settings.
Before you set out to tweak and tune the configuration, make sure you
understand what are you trying to accomplish and the consequences.
The primary way of configuring a node is via this file. This template lists
the most important settings you may want to configure for a production cluster.
Please consult the documentation for further information on configuration options:
Elasticsearch Guide | Elastic
---------------------------------- Cluster -----------------------------------
Use a descriptive name for your cluster:
#cluster.name: my-application
------------------------------------ Node ------------------------------------
Use a descriptive name for the node:
#node.name: node-1
Add custom attributes to the node:
#node.attr.rack: r1
----------------------------------- Paths ------------------------------------
Path to directory where to store the data (separate multiple locations by comma):
#path.data: /var/lib/Elasticsearch
Path to log files:
#path.logs: /var/log/Elasticsearch
----------------------------------- Memory -----------------------------------
Lock the memory on startup:
#bootstrap.memory_lock: true
Make sure that the heap size is set to about half the memory available
on the system and that the owner of the process is allowed to use this
limit.
Elasticsearch performs poorly when the system is swapping the memory.
---------------------------------- Network -----------------------------------
By default Elasticsearch is only accessible on localhost. Set a different
address here to expose this node on the network:
#network.host: 192.168.0.1
By default Elasticsearch listens for HTTP traffic on the first free port it
finds starting at 9200. Set a specific HTTP port here:
#http.port: 9200
For more information, consult the network module documentation.
--------------------------------- Discovery ----------------------------------
Pass an initial list of hosts to perform discovery when this node is started:
The default list of hosts is ["127.0.0.1", "[::1]"]
#discovery.seed_hosts: ["host1", "host2"]
Bootstrap the cluster using an initial set of master-eligible nodes:
#cluster.initial_master_nodes: ["node-1", "node-2"]
For more information, consult the discovery and cluster formation module documentation.
--------------------------------- Readiness ----------------------------------
Enable an unauthenticated TCP readiness endpoint on localhost
#readiness.port: 9399
---------------------------------- Various -----------------------------------
Allow wildcard deletion of indices:
#action.destructive_requires_name: false
#----------------------- BEGIN SECURITY AUTO CONFIGURATION -----------------------
The following settings, TLS certificates, and keys have been automatically
generated to configure Elasticsearch security features on 15-06-2022 10:03:20
--------------------------------------------------------------------------------
Enable security features
xpack.security.enabled: true
xpack.security.enrollment.enabled: true
Enable encryption for HTTP API client connections, such as Kibana, Logstash, and Agents
xpack.security.http.ssl:
enabled: true
keystore.path: certs/http.p12
Enable encryption and mutual authentication between cluster nodes
xpack.security.transport.ssl:
enabled: true
verification_mode: certificate
keystore.path: certs/transport.p12
truststore.path: certs/transport.p12
Create a new cluster with the current node only
Additional nodes can still join the cluster later
cluster.initial_master_nodes: ["es-master-1"]
Allow HTTP API connections from anywhere
Connections are encrypted and require user authentication
http.host: 0.0.0.0
Allow other nodes to join the cluster from anywhere
Connections are encrypted and mutually authenticated
#transport.host: 0.0.0.0
#----------------------- END SECURITY AUTO CONFIGURATION -------------------------
cluster.name: elk-production
node.name: ${HOSTNAME}
node.roles: [data]
path.data: /fs1/Elasticsearch/data
path.logs: /fs1/Elasticsearch/logs
network.host: 0.0.0.0
discovery.seed_hosts: ["es-master-1"]
errors i am getting is:
[root@es-master-1 Elasticsearch]# /usr/share/Elasticsearch/bin/Elasticsearch-reset-password -u elastic -i
Failed to determine the health of the cluster. Cluster health is currently RED.
This means that some cluster data is unavailable and your cluster is not fully functional.
The cluster logs (Logging | Elasticsearch Guide [8.2] | Elastic) might contain information/indications for the underlying cause
It is recommended that you resolve the issues with your cluster before continuing
It is very likely that the command will fail when run against an unhealthy cluster.
If you still want to attempt to execute this command against an unhealthy cluster, you can pass the -f parameter.
ERROR: Failed to determine the health of the cluster. Cluster health is currently RED.
[root@es-master-1 Elasticsearch]#
[root@es-master-1 Elasticsearch]# curl --cacert /etc/Elasticsearch/certs/http_ca.crt -u elastic https://localhost:9200
Enter host password for user 'elastic':
{"error":{"root_cause":[{"type":"security_exception","reason":"unable to authenticate user [elastic] for REST request [/]","header":{"WWW-Authenticate":["Basic realm="security" charset="UTF-8"","Bearer realm="security"","ApiKey"]}}],"type":"security_exception","reason":"unable to authenticate user [elastic] for REST request [/]","header":{"WWW-Authenticate":["Basic realm="security" charset="UTF-8"","Bearer realm="security"","ApiKey"]}},"status":401}[
Did you use security auto-configuration for both nodes?
If so, that feature only works for standalone nodes. If each node is auto-configured, they will have unique generated certs and user passwords.
For clustering, I think you will need to setup TLS certs and user passwords manually.
1 Like
Not really, one can still use the enrollment process and have a multi node cluster with security automatically configured. See our documentation in Start the Elastic Stack with security enabled automatically | Elasticsearch Guide [8.11] | Elastic
1 Like
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.