強化ELK平台ElasticSearch的安全性

在前一篇安裝說明時，是將ElasticSearch的9200 port開放出來，但這樣一來，所有人都可以操作ElasticSearch。

本篇關閉了9200~9300的對外port，限定只能從localhost存取ElasticSearch，然後利用apache的proxy功能，讓Kinaba透過80port 存取Elastic Search。

1. 修改 /etc/elasticsearch/elasticsearch.yml 設定檔，新增以下兩行，限定只能在本機連結ElasticSearch

   script.disable_dynamic: true
   network.host: localhost
   

   
   
2. 修改 Apache的設定， 在 /etc/httpd/conf.d 中新增檔案 elk.conf (名稱可以自訂)
   

   # Courtesy of https://github.com/sgzijl
   # config.js includes elasticsearch:    "https://"+window.location.hostname+":80",
   
   <VirtualHost *:80>
     ServerName LogServer
   
     DocumentRoot /var/www/html
     <Directory /var/www/html>
       Allow from all
       Options -Multiviews
     </Directory>
   
     # Set global proxy timeouts
     <Proxy http://127.0.0.1:9200>
       ProxySet connectiontimeout=5 timeout=90
     </Proxy>
   
     # Proxy for _aliases and .*/_search
     <LocationMatch "^/(_nodes|_aliases|.*/_aliases|_search|.*/_search|_mapping|.*/_mapping)$">
       ProxyPassMatch http://127.0.0.1:9200/$1
       ProxyPassReverse http://127.0.0.1:9200/$1
     </LocationMatch>
   
     # Proxy for kibana-int/{dashboard,temp} stuff (if you don't want auth on /, then you will want these to be protected)
     <LocationMatch "^/(kibana-int/dashboard/|kibana-int/temp)(.*)$">
       ProxyPassMatch http://127.0.0.1:9200/$1$2
       ProxyPassReverse http://127.0.0.1:9200/$1$2
     </LocationMatch>
   
     # Optional disable auth for a src IP (eg: your monitoring host or subnet)
     <Location />
       Allow from 10.10.10.*
       Deny from all
       Satisfy any
   
       AuthType Basic
       AuthName "Log Server Authentication"
       AuthUserFile /var/www/html/.htpasswd
       require valid-user
     </Location>
   
   </VirtualHost>
   
   

   
   
3. 在/var/www/html 目錄下增加 .htpasswd 作為使用者認證

   # htpasswd -c .htpasswd <username>
   New password:
   Re-type new password:
   Adding password for user <username>
   #
   
   

   
   
4. 修正防火牆 iptables ，關閉原本開放的 9200-9300 port

   #!/bin/bash
   #
   # iptables 範例設定腳本
   #
   # 清除 iptables 內一切現存的規則
   #
   iptables -F
   #
   # 容讓 SSH 連線到 tcp 連接埠 22
   # 當透過 SSH 遠端連線到伺服器，你必須這樣做才能群免被封鎖於系統外
   #
   iptables -A INPUT -p tcp --dport 22 -j ACCEPT
   #
   # 開啟HTTP 80 port
   #
   iptables -A INPUT -p tcp --dport 80 -j ACCEPT
   #
   # 設定ElasticSearch使用的port 9200-9300
   #
   #iptables -A INPUT -p tcp --dport 9200:9300 -j ACCEPT
   #
   # 設定 INPUT、FORWARD、及 OUTPUT 鏈的預設政策
   #
   iptables -P INPUT DROP
   iptables -P FORWARD DROP
   iptables -P OUTPUT ACCEPT
   #
   # 設定 localhost 的存取權
   #
   iptables -A INPUT -i lo -j ACCEPT
   #
   # 接納屬於現存及相關連線的封包
   #
   iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
   #
   # 儲存設定
   #
   /sbin/service iptables save
   #
   # 列出規則
   #
   iptables -L -v
   
   

   
   
5. 修改Kibana的 config.js檔案 (/var/www.html)，將原本 9200 port改為 80 port

    elasticsearch: "http://"+window.location.hostname+":80"