ELK6.2.3日志分析工具搭x-pack破解安装(三)

朱雀 2022-05-25 03:06 180阅读 0赞

一、elasticsearch安装x-pack

1.切换安装目录

root@ubuntu: cd /usr/local/elk/elasticsearch-6.2.3/bin

2.执行安装命令

root@ubuntu:/usr/local/elk/elasticsearch-6.2.3/bin# ./elasticsearch-plugin install x-pack
    -> Downloading x-pack from elastic
    [=================================================] 100%  
    @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
    @ WARNING: plugin requires additional permissions @
    @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
    * java.io.FilePermission \\.\pipe\* read,write
    * java.lang.RuntimePermission accessClassInPackage.com.sun.activation.registries
    * java.lang.RuntimePermission getClassLoader
    * java.lang.RuntimePermission setContextClassLoader
    * java.lang.RuntimePermission setFactory
    * java.net.SocketPermission * connect,accept,resolve
    * java.security.SecurityPermission createPolicy.JavaPolicy
    * java.security.SecurityPermission getPolicy
    * java.security.SecurityPermission putProviderProperty.BC
    * java.security.SecurityPermission setPolicy
    * java.util.PropertyPermission * read,write
    See http://docs.oracle.com/javase/8/docs/technotes/guides/security/permissions.html
    for descriptions of what these permissions allow and the associated risks.
    
    Continue with installation? [y/N]y
    @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
    @ WARNING: plugin forks a native controller @
    @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
    This plugin launches a native controller that is not subject to the Java
    security manager nor to system call filters.
    
    Continue with installation? [y/N]y
    Elasticsearch keystore is required by plugin [x-pack-security], creating...
    -> Installed x-pack with: x-pack-security,x-pack-logstash,x-pack-core,x-pack-upgrade,x-pack-watcher,x-pack-monitoring,x-pack-ml,x-pack-deprecation,x-pack-graph

3.授权

root@ubuntu: cd /usr/local/elk/elasticsearch-6.2.3
    root@ubuntu: chown -R elasticsearch.elasticsearch *

4.重启elasticsearch kill进程

root@ubuntu: su elasticsearch -l -c "/usr/local/elk/elasticsearch-6.2.3/bin/elasticsearch -d"

5.登入http://192.168.15.69:9200 已经出现验证界面

![70][]

6. 修改密码 setup-passwords interactive

root@ubuntu:/usr/local/elk/elasticsearch-6.2.3/bin# x-pack/setup-passwords interactive
    Initiating the setup of passwords for reserved users elastic,kibana,logstash_system.
    You will be prompted to enter passwords as the process progresses.
    Please confirm that you would like to continue [y/N]y
     
     
    Enter password for [elastic]:
    Reenter password for [elastic]:
    Enter password for [kibana]:
    Reenter password for [kibana]:
    Enter password for [logstash_system]:
    Reenter password for [logstash_system]:
    Changed password for user [kibana]
    Changed password for user [logstash_system]
    Changed password for user [elastic]

#查询所有用户
    curl -XGET -u elastic 'localhost:9200/_xpack/security/user?pretty'
    #查询所有Roles
    curl -XGET -u elastic 'localhost:9200/_xpack/security/role'

二、kibana 安装x-pack

1.执行安装界面

root@ubuntu:/usr/local/elk/kibana-6.2.3-linux-x86_64/bin# ./kibana-plugin install x-pack

2.添加配置文件kibana.yml

#登入elasticsearch 账号密码
    elasticsearch.username: "elastic"
    elasticsearch.password: "123abc"
    #下面2条启动警告信息
    xpack.reporting.encryptionKey: "a_random_string"
    xpack.security.encryptionKey: "something_at_least_32_characters"

3.重启kibana kill进程

root@ubuntu:/usr/local/elk/kibana-6.2.3-linux-x86_64/bin/kibana &

4.登入http://192.168.15.69:5601/

![70 1][]

5.进去kibana使用elastic账户登入

![70 2][]

三、破解x-pack

查看到期时间

root@ubuntu:curl -XGET -u elastic:123abc "http://192.168.15.69:9200/_license"

覆盖反编译的jar文件

root@ubuntu:cp -rf x-pack-core-6.2.3.jar /usr/local/elk/elasticsearch-6.2.3/plugins/x-pack/x-pack-core/

申请一个免费license(https://license.elastic.co/registration) 注册后可以下载文件,下载后修改，例如：

主要修改：type改为platinum表示可以使用所有功能 ; expiry\_date\_in\_millis  我这里改了10年

issue_date_in_millis":1490832000000

因为elasticsearch 6.2.3，现在更新license文件时，要么配置SSL\\TLS，要么就禁用security。

更新之前先配置elasticsearch.yml，加入：

xpack.security.enabled: false

重启elasticsearch

执行更新license语句

root@ubuntu:curl -XPUT -u elastic:123abc 'http://192.168.15.69:9200/_xpack/license?acknowledge=true' -H "Content-Type: application/json" -d @license.json

生效之后，配置elasticsearch.yml 再开启security，并开启SSL\\TLS：

xpack.security.enabled: true
    xpack.security.transport.ssl.enabled: true

最后重启elasticsearch。

查看License状态：

root@ubuntu:curl -XGET -u elastic:123abc "http://192.168.15.69:9200/_license"

或登入kibana查看

![70 3][]

[70]: /images/20220525/e40087d9b0ce402ca4b14ca100a49b49.png
[70 1]: /images/20220525/a899baec7dcf4a6581ce18ec7a4a7347.png
[70 2]: /images/20220525/613fe530ca544fd4a2a9a5a52e610d28.png
[70 3]: /images/20220525/a55fa8c040bb47d3b7181a08270f94f1.png