自動生成和配置ES的安全證書
阿新 • • 發佈：2020-08-21
系統工具安裝
1.下載離線的rpm包
yum -y install yum-utils
yumdownloader expect 把rpm包下載到本地
yumdownloader tcl
2.下載原始碼包需要首先編譯安裝 如果沒有gcc的話就會編譯失敗.如果是下載的rpm包則不會出現依賴問題
3.rpm包自動包含了軟體包所有的依賴的其它包
啟動ES設定讀取證書檔案許可權
使用不同的jdk需要設定到對應的策略檔案
自動建立證書
function create_certs() { expect <<EOF spawn ${ES_INSTALL_DIR}建立證書/bin/elasticsearch-certutil cert --ip ${IP} --pem expect { #"Please enter the desired output file [certificate-bundle.zip]" { send "\n"} "Please enter the desired output file" { send "\n"} } expect eof EOF echo "證書生成完畢${ES_INSTALL_DIR}/certificate-bundle.zip"rm -fr ${ES_INSTALL_DIR}/ca rm -fr ${ES_INSTALL_DIR}/instance unzip ${ES_INSTALL_DIR}/certificate-bundle.zip -d ${ES_INSTALL_DIR} #unzip ${ES_INSTALL_DIR}/certificate-bundle.zip chown -R ${ES_USER}:${ES_USER} ${ES_INSTALL_DIR} } function modify_elastichyml() { ymlpath=${ES_INSTALL_DIR}/config cp ../../etc/elasticsearch/elasticsearch.yml ${ymlpath}/ #cp ../../etc/elasticsearch/elasticsearch.yml ${ymlpath}/elasticsearch.yml sed -i "s#__ip__#${IP}#g" ${ymlpath}/elasticsearch.yml sed -i "s#__es_install_dir__#${ES_INSTALL_DIR}#g" ${ymlpath}/elasticsearch.yml javafile=${ES_INSTALL_DIR}/jdk/conf/security/java.policy javafile2=${INSTALL_DIR}/jdk/jre/lib/security/java.policy sed -i "/permission java.util.PropertyPermission \"java.vm.name\", \"read\";/a permission java.io.FilePermission \"${ES_INSTALL_DIR}/ca/ca.crt\", \"read,write\";" ${javafile} sed -i "/permission java.util.PropertyPermission \"java.vm.name\", \"read\";/a permission java.io.FilePermission \"${ES_INSTALL_DIR}/ca\", \"read,write\";" ${javafile} sed -i "/permission java.util.PropertyPermission \"java.vm.name\", \"read\";/a permission java.io.FilePermission \"${ES_INSTALL_DIR}/instance/instance.key\", \"read,write\";" ${javafile} sed -i "/permission java.util.PropertyPermission \"java.vm.name\", \"read\";/a permission java.io.FilePermission \"${ES_INSTALL_DIR}/instance/instance.crt\", \"read,write\";" ${javafile} sed -i "/permission java.util.PropertyPermission \"java.vm.name\", \"read\";/a permission java.io.FilePermission \"${ES_INSTALL_DIR}/instance\", \"read,write\";" ${javafile} sed -i "/permission java.util.PropertyPermission \"java.vm.name\", \"read\";/a permission java.io.FilePermission \"${ES_INSTALL_DIR}/ca/ca.crt\", \"read,write\";" ${javafile2} sed -i "/permission java.util.PropertyPermission \"java.vm.name\", \"read\";/a permission java.io.FilePermission \"${ES_INSTALL_DIR}/ca\", \"read,write\";" ${javafile2} sed -i "/permission java.util.PropertyPermission \"java.vm.name\", \"read\";/a permission java.io.FilePermission \"${ES_INSTALL_DIR}/instance/instance.key\", \"read,write\";" ${javafile2} sed -i "/permission java.util.PropertyPermission \"java.vm.name\", \"read\";/a permission java.io.FilePermission \"${ES_INSTALL_DIR}/instance/instance.crt\", \"read,write\";" ${javafile2} sed -i "/permission java.util.PropertyPermission \"java.vm.name\", \"read\";/a permission java.io.FilePermission \"${ES_INSTALL_DIR}/instance\", \"read,write\";" ${javafile2} sed -i "/# End of file/i * soft nofile 65536" /etc/security/limits.conf sed -i "/# End of file/i * hard nofile 65536" /etc/security/limits.conf sysctl -w vm.max_map_count=262144 }
自動建立密碼
建立密碼的時候必須要等待es服務正常啟動後才能執行 而不能在安裝後立即執行
passwd=123456 expect <<EOF spawn /app/chuangfa/taishi/elasticsearch/bin/elasticsearch-setup-passwords interactive --batch --url https://192.168.19.135:9200 expect { "elastic" { send "$passwd\n";exp_continue} "elastic" { send "$passwd\n";exp_continue} "apm_system" { send "$passwd\n";exp_continue} "apm_system" { send "$passwd\n";exp_continue} "kibana_system" { send "$passwd\n";exp_continue} "kibana_system" { send "$passwd\n";exp_continue} "logstash_system" { send "$passwd\n";exp_continue} "logstash_system" { send "$passwd\n";exp_continue} "beats_system" { send "$passwd\n";exp_continue} "beats_system" { send "$passwd\n";exp_continue} "remote_monitoring_user" { send "$passwd\n";exp_continue} "remote_monitoring_user" { send "$passwd\n"} } expect eof EOF echo "密碼生成完畢"建立密碼
function modify_conf() { #ES supervisord啟動配置 mkdir -p ${INSTALL_DIR}/etc/supervisord elasticsearch_ini=${INSTALL_DIR}/etc/supervisord/elasticsearch.ini elasticsearch_program=elasticsearch cp ../../etc/supervisord/elasticsearch.ini ${elasticsearch_ini} sed -i "s#__es_install_dir__#${ES_INSTALL_DIR}#g" ${elasticsearch_ini} sed -i "s#__install_dir__#${INSTALL_DIR}#g" ${elasticsearch_ini} sed -i "s#__program__#${elasticsearch_program}#g" ${elasticsearch_ini} if [ ${USER} == "root" ];then sed -i "s#__user__#${ES_USER}#g" ${elasticsearch_ini} chown -R ${ES_USER}:${ES_USER} ${elasticsearch_ini} else sed -i "s#__user__#${USER}#g" ${elasticsearch_ini} chown -R ${USER}:${USER} ${elasticsearch_ini} fi #es配置 mkdir -p ${INSTALL_DIR}/etc rm -f ${ES_INSTALL_DIR}/config/elasticsearch.yml # cp ../../etc/elasticsearch/elasticsearch.yml ${ES_INSTALL_DIR}/config/ # sed -i "s#__es_install_dir__#${ES_INSTALL_DIR}#g" ${ES_INSTALL_DIR}/config/elasticsearch.yml # cp ../../etc/elasticsearch/jvm.options ${ES_INSTALL_DIR}/config/ # cp ../../etc/elasticsearch/log4j2.properties ${ES_INSTALL_DIR}/config/ if [ ${USER} == "root" ];then # shell中的:號表示pass 什麼也不執行 chown -R ${ES_USER}:${ES_USER} ${MODE_DIR} chown -R ${ES_USER}:${ES_USER} ${ES_INSTALL_DIR} # 直接修改目錄的屬主和屬組即可 目錄下的所有檔案都可以被修改掉 #chown -R ${ES_USER}:${ES_USER} ${ES_INSTALL_DIR}/config/elasticsearch.yml #chown -R ${ES_USER}:${ES_USER} ${ES_INSTALL_DIR}/config/jvm.options #chown -R ${ES_USER}:${ES_USER} ${ES_INSTALL_DIR}/config/log4j2.properties else : fi } function Install() { #獲取ES安裝包 getPackage=`ls -l ../../src/ | grep "elasticsearch-[0-9]" | awk '{print $9}'` echo "Obtain elasticsearch installation package ${getPackage}" #解壓es安裝包 tar zxvf ../../src/${getPackage} -C ../../tmp/ 2>&1 >/dev/null #獲取es解壓目錄 getName=`ls -l ../../tmp/ | grep "elasticsearch" | awk '{print $9}'` echo "Get directory ${getName}" echo "${ES_INSTALL_DIR}" mv ../../tmp/${getName} ${ES_INSTALL_DIR} } function main() { #預設es版本呢 es_version_tmp=`ls -l ../../src/ | grep "elasticsearch-[0-9]" | awk '{print $9}' | grep -oE '[0-9]+\.[0-9\.]+'` es_version=${es_version_tmp%?} echo "es version ${es_version}" Install modify_conf create_certs modify_elastichyml create_passwd } function create_certs() { expect <<EOF spawn ${ES_INSTALL_DIR}/bin/elasticsearch-certutil cert --ip ${IP} --pem expect { #"Please enter the desired output file [certificate-bundle.zip]" { send "\n"} "Please enter the desired output file" { send "\n"} } expect eof EOF echo "證書生成完畢${ES_INSTALL_DIR}/certificate-bundle.zip" rm -fr ${ES_INSTALL_DIR}/ca rm -fr ${ES_INSTALL_DIR}/instance unzip ${ES_INSTALL_DIR}/certificate-bundle.zip -d ${ES_INSTALL_DIR} #unzip ${ES_INSTALL_DIR}/certificate-bundle.zip chown -R ${ES_USER}:${ES_USER} ${ES_INSTALL_DIR} } function modify_elastichyml() { ymlpath=${ES_INSTALL_DIR}/config cp ../../etc/elasticsearch/elasticsearch.yml ${ymlpath}/ #cp ../../etc/elasticsearch/elasticsearch.yml ${ymlpath}/elasticsearch.yml sed -i "s#__ip__#${IP}#g" ${ymlpath}/elasticsearch.yml sed -i "s#__es_install_dir__#${ES_INSTALL_DIR}#g" ${ymlpath}/elasticsearch.yml javafile=${ES_INSTALL_DIR}/jdk/conf/security/java.policy javafile2=${INSTALL_DIR}/jdk/jre/lib/security/java.policy sed -i "/permission java.util.PropertyPermission \"java.vm.name\", \"read\";/a permission java.io.FilePermission \"${ES_INSTALL_DIR}/ca/ca.crt\", \"read,write\";" ${javafile} sed -i "/permission java.util.PropertyPermission \"java.vm.name\", \"read\";/a permission java.io.FilePermission \"${ES_INSTALL_DIR}/ca\", \"read,write\";" ${javafile} sed -i "/permission java.util.PropertyPermission \"java.vm.name\", \"read\";/a permission java.io.FilePermission \"${ES_INSTALL_DIR}/instance/instance.key\", \"read,write\";" ${javafile} sed -i "/permission java.util.PropertyPermission \"java.vm.name\", \"read\";/a permission java.io.FilePermission \"${ES_INSTALL_DIR}/instance/instance.crt\", \"read,write\";" ${javafile} sed -i "/permission java.util.PropertyPermission \"java.vm.name\", \"read\";/a permission java.io.FilePermission \"${ES_INSTALL_DIR}/instance\", \"read,write\";" ${javafile} sed -i "/permission java.util.PropertyPermission \"java.vm.name\", \"read\";/a permission java.io.FilePermission \"${ES_INSTALL_DIR}/ca/ca.crt\", \"read,write\";" ${javafile2} sed -i "/permission java.util.PropertyPermission \"java.vm.name\", \"read\";/a permission java.io.FilePermission \"${ES_INSTALL_DIR}/ca\", \"read,write\";" ${javafile2} sed -i "/permission java.util.PropertyPermission \"java.vm.name\", \"read\";/a permission java.io.FilePermission \"${ES_INSTALL_DIR}/instance/instance.key\", \"read,write\";" ${javafile2} sed -i "/permission java.util.PropertyPermission \"java.vm.name\", \"read\";/a permission java.io.FilePermission \"${ES_INSTALL_DIR}/instance/instance.crt\", \"read,write\";" ${javafile2} sed -i "/permission java.util.PropertyPermission \"java.vm.name\", \"read\";/a permission java.io.FilePermission \"${ES_INSTALL_DIR}/instance\", \"read,write\";" ${javafile2} sed -i "/# End of file/i * soft nofile 65536" /etc/security/limits.conf sed -i "/# End of file/i * hard nofile 65536" /etc/security/limits.conf sysctl -w vm.max_map_count=262144 } function setpasswd() { passwd=${ES_PASSWD} expect <<EOF spawn ${ES_INSTALL_DIR}/bin/elasticsearch-setup-passwords interactive --batch --url https://${IP}:9200 expect { "elastic" { send "$passwd\n";exp_continue} "elastic" { send "$passwd\n";exp_continue} "apm_system" { send "$passwd\n";exp_continue} "apm_system" { send "$passwd\n";exp_continue} "kibana_system" { send "$passwd\n";exp_continue} "kibana_system" { send "$passwd\n";exp_continue} "logstash_system" { send "$passwd\n";exp_continue} "logstash_system" { send "$passwd\n";exp_continue} "beats_system" { send "$passwd\n";exp_continue} "beats_system" { send "$passwd\n";exp_continue} "remote_monitoring_user" { send "$passwd\n";exp_continue} "remote_monitoring_user" { send "$passwd\n"} } expect eof EOF } function create_passwd() { su - ${ES_USER} -c ${ES_INSTALL_DIR}/bin/elasticsearch & > /dev/null 2>&1 local count=0 for((i=1;i<=5;i++)); do count=`netstat -antp | grep 9200 | wc -l` sleep 5 if [ "$count" -gt 0 ];then break fi done if [ "$count" -gt 0 ];then echo "ES success to start. set user passwd" setpasswd else echo "ES failed to start in 5 minutes." fi sleep 3 } if [ $# -eq 0 ]; then __ReadINI ../../conf/.config.ini main else __Plugin_Deployment_Before $1 main 2>&1 | tee -a ../../log/enterprise.log __Plugin_Deployment_After fi完整流程
登入ES
shell執行幾點區別
su - user -c program
其中user為使用者名稱 program為要執行的程式, 如su - isoa -c /usr/isoa/bin/gtimer.sh
第一行指定解析器的話 啟動執行的需要使用./start-cluster.sh的方式 使用 sh start-cluster.sh的方式可能會出現執行失敗的情況
linux ./a.sh 命令與sh a.sh的區別為：可執行屬性不同、執行方式不同、相容性不同。
一、可執行屬性不同
1、 ./a.sh 命令： ./a.sh 命令的檔案必須具有可執行屬性
2、 sh a.sh命令：sh a.sh命令的檔案不必具有可執行屬性
二、執行方式不同
1、 ./a.sh 命令：./a.sh 命令使用指令碼中第一行所指定的命令來解釋和執行檔案
2、 sh a.sh命令：sh a.sh命令使用shell工具的SH指令碼直接解釋和執行檔案