Question

最近，我一直试图让Elasticsearch可以通过SSL使用。这让我走上了一条有趣的途径，从apache到nginx到apache到nginx，现在终于回到了apache。

我需要LDAP进行身份验证，这就是我停止使用nginx的原因。我按照https://gist.github.com/jerrac/0a8bd96e6c42eb84b6f2来配置我的apache Web服务器。好的是我能够访问它。不好的是，弹性搜索在寻找指数时并不起作用。我使用elasticsearch-head确保它不是其他任何东西，但似乎即使我可以访问kibana网页，elasticsearch仍然被阻止。任何帮助，将不胜感激。

<VirtualHost *:80>

ServerAdmin systems@example.com
ServerName logstash.example.com

DocumentRoot /var/www/kibana/
<Directory />
Options FollowSymLinks
AllowOverride None
</Directory>
<Directory /var/www/kibana/>
Options -Indexes FollowSymLinks -MultiViews
AllowOverride all
Order allow,deny
allow from all
</Directory>

 RewriteEngine on
 RewriteCond %{HTTPS} off
 RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
#RewriteRule ^/(.*)$ https://logstash.example.com/$1 [R,L]

 ErrorLog /var/log/apache2/error.log
 CustomLog /var/log/apache2/access.log combined

</VirtualHost>

<IfModule mod_ssl.c>
<VirtualHost *:443>
    ServerAdmin systems@example.com
    ServerName logstash.example.com

  SSLEngine on
  SSLCertificateFile           /etc/ssl/certs/wildcard.example.com.crt
  SSLCertificateKeyFile        /etc/ssl/private/wildcard.example.com.key
  SSLCACertificateFile         /etc/ssl/certs/ca-example.cert
  #RewriteEngine on
  #RewriteCond %{SERVER_NAME} !=logstash.example.com
  #RewriteRule ^/(.*)$ https://logstash.eaxmple.com/$1 [R,L]

 ErrorLog /var/log/apache2/error.log
 CustomLog /var/log/apache2/access.log combined

    DocumentRoot /var/www/kibana/
    <Directory />
            Options FollowSymLinks
            AllowOverride None
    </Directory>
    <Directory /var/www/kibana/>
            Options Indexes FollowSymLinks MultiViews
            AllowOverride None
            Order allow,deny
            allow from all
    </Directory>
    <FilesMatch "\.(cgi|shtml|phtml|php)$">
    SSLOptions +StdEnvVars
</FilesMatch>
<Directory /usr/lib/cgi-bin>
    SSLOptions +StdEnvVars
</Directory>
 BrowserMatch "MSIE [2-6]" \
    nokeepalive ssl-unclean-shutdown \
    downgrade-1.0 force-response-1.0
# MSIE 7 and newer should be able to use keepalive
BrowserMatch "MSIE [7-9]" ssl-unclean-shutdown
#ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
    #<Directory "/usr/lib/cgi-bin">
    #        AllowOverride None
    #        Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
    #        Order allow,deny
    #        Allow from all
    #</Directory>

    ErrorLog ${APACHE_LOG_DIR}/error.log

    # Possible values include: debug, info, notice, warn, error, crit,
    # alert, emerg.
    LogLevel warn

    CustomLog ${APACHE_LOG_DIR}/access.log combined

<Proxy http://127.0.0.1:9200>
 #<Proxy http://logstash.example.com:9200>
        ProxySet connectiontimeout=5 timeout=90
</Proxy>

# Proxy for _aliases and .*/_search
<LocationMatch "^(/_aliases|.*/_search|.*/_mapping|/_nodes)$">
        #ProxyPassMatch http://logstash.example.com:9200
        #ProxyPassReverse http://logstash.example.com:9200
    ProxyPassMatch http://127.0.0.1:9200
        ProxyPassReverse http://127.0.0.1:9200
</LocationMatch>

# Proxy for kibana-int/{dashboard,temp} stuff (if you don't want auth on /, then you will want these to be protected)
<LocationMatch "^(/kibana-int/dashboard/|/kibana-int/temp).*$">
        #ProxyPassMatch http://logstash.example.com:9200
        #ProxyPassReverse http://logstash.example.com:9200
        ProxyPassMatch http://127.0.0.1:9200
        ProxyPassReverse http://127.0.0.1:9200
</LocationMatch>

</VirtualHost>
</IfModule>

Answer 1

如果Kibana正在使用，您应该能够使用上述配置https://myserver/index_name/_search/。

您的LocationMatch es仅允许非常小的信息子集。您既可以明确列出索引（例如/index1/.*|/index2/.*），也可以提供更灵活的映射（例如，索引名称中包含已知模式）。

<LocationMatch "^/(_aliases|index1/.*|index2/.*|_nodes)$">

可能值得注意的是，暴露您的Elasticsearch数据库是非常危险的，即使它使用SSL，因为一旦您允许自由访问，那么他们就可以从中获取所有数据（以及其他有风险的操作），这会使目的是加密大部分流量。

使用apache2 ssl代理进行Elasticsearch

1 个答案: