在前一篇安裝說明時，是將ElasticSearch的9200 port開放出來，但這樣一來，所有人都可以操作ElasticSearch。
本篇關閉了9200~9300的對外port，限定只能從localhost存取ElasticSearch，然後利用apache的proxy功能，讓Kinaba透過80port 存取Elastic Search。
- 修改 /etc/elasticsearch/elasticsearch.yml 設定檔，新增以下兩行，限定只能在本機連結ElasticSearch
script.disable_dynamic: true
network.host: localhost - 修改 Apache的設定， 在 /etc/httpd/conf.d 中新增檔案 elk.conf (名稱可以自訂)
# Courtesy of https://github.com/sgzijl
# config.js includes elasticsearch: "https://"+window.location.hostname+":80",
<VirtualHost *:80>
ServerName LogServer
DocumentRoot /var/www/html
<Directory /var/www/html>
Allow from all
Options -Multiviews
</Directory>
# Set global proxy timeouts
<Proxy http://127.0.0.1:9200>
ProxySet connectiontimeout=5 timeout=90
</Proxy>
# Proxy for _aliases and .*/_search
<LocationMatch "^/(_nodes|_aliases|.*/_aliases|_search|.*/_search|_mapping|.*/_mapping)$">
ProxyPassMatch http://127.0.0.1:9200/$1
ProxyPassReverse http://127.0.0.1:9200/$1
</LocationMatch>
# Proxy for kibana-int/{dashboard,temp} stuff (if you don't want auth on /, then you will want these to be protected)
<LocationMatch "^/(kibana-int/dashboard/|kibana-int/temp)(.*)$">
ProxyPassMatch http://127.0.0.1:9200/$1$2
ProxyPassReverse http://127.0.0.1:9200/$1$2
</LocationMatch>
# Optional disable auth for a src IP (eg: your monitoring host or subnet)
<Location />
Allow from 10.10.10.*
Deny from all
Satisfy any
AuthType Basic
AuthName "Log Server Authentication"
AuthUserFile /var/www/html/.htpasswd
require valid-user
</Location>
</VirtualHost> - 在/var/www/html 目錄下增加 .htpasswd 作為使用者認證
# htpasswd -c .htpasswd <username>
New password:
Re-type new password:
Adding password for user <username>
# - 修正防火牆 iptables ，關閉原本開放的 9200-9300 port
#!/bin/bash
#
# iptables 範例設定腳本
#
# 清除 iptables 內一切現存的規則
#
iptables -F
#
# 容讓 SSH 連線到 tcp 連接埠 22
# 當透過 SSH 遠端連線到伺服器，你必須這樣做才能群免被封鎖於系統外
#
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
#
# 開啟HTTP 80 port
#
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
#
# 設定ElasticSearch使用的port 9200-9300
#
#iptables -A INPUT -p tcp --dport 9200:9300 -j ACCEPT
#
# 設定 INPUT、FORWARD、及 OUTPUT 鏈的預設政策
#
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
#
# 設定 localhost 的存取權
#
iptables -A INPUT -i lo -j ACCEPT
#
# 接納屬於現存及相關連線的封包
#
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#
# 儲存設定
#
/sbin/service iptables save
#
# 列出規則
#
iptables -L -v - 修改Kibana的 config.js檔案 (/var/www.html)，將原本 9200 port改為 80 port
elasticsearch: "http://"+window.location.hostname+":80"
