将 Amazon 的 Elasticsearch 与 VPC 和安全组结合使用,即使您在安全组中添加例外,也无法从 VPC 外部的终端节点访问终端节点。
因此,必须设置反向代理才能从 VPC 外部访问集群。
我正在尝试使用微小代理配置它,但失败了。所有对本地主机的 curl 请求:443 给我 curl:(52( 来自服务器的空回复
我正在支持这种配置,因为我以前从未设置过代理。
当我执行 curl -XGET http://localhost:8888
挂...
这是我的日志(它循环此输出(
NOTICE Jan 29 01:27:46 [10561]: Waiting servers (0) is less than MinSpareServers (5). Creating new child.
CONNECT Jan 29 01:27:46 [10574]: Connect (file descriptor 6): localhost [127.0.0.1]
CONNECT Jan 29 01:27:46 [10574]: Request (file descriptor 6): GET / HTTP/1.0
INFO Jan 29 01:27:46 [10574]: process_request: trans Host GET http://127.0.0.1:8888/ for 6
INFO Jan 29 01:27:46 [10574]: No upstream proxy for 127.0.0.1
CONNECT Jan 29 01:27:46 [10574]: Established connection to host "127.0.0.1" using file descriptor 7.
NOTICE Jan 29 01:27:51 [10561]: Waiting servers (0) is less than MinSpareServers (5). Creating new child.
CONNECT Jan 29 01:27:51 [10575]: Connect (file descriptor 6): localhost [127.0.0.1]
CONNECT Jan 29 01:27:51 [10575]: Request (file descriptor 6): GET / HTTP/1.0
INFO Jan 29 01:27:51 [10575]: process_request: trans Host GET http://127.0.0.1:8888/ for 6
INFO Jan 29 01:27:51 [10575]: No upstream proxy for 127.0.0.1
CONNECT Jan 29 01:27:51 [10575]: Established connection to host "127.0.0.1" using file descriptor 7.
这是我的配置文件:
User nobody
Group nogroup
Port 8888
Timeout 600
DefaultErrorFile "/usr/share/tinyproxy/default.html"
StatFile "/usr/share/tinyproxy/stats.html"
Logfile "/var/log/tinyproxy/tinyproxy.log"
LogLevel Info
PidFile "/var/run/tinyproxy/tinyproxy.pid"
upstream localhost:8888 "https://vpc-test-urlinfo.es.amazonaws.com"
MaxClients 100
MinSpareServers 5
MaxSpareServers 20
StartServers 10
MaxRequestsPerChild 0
Allow 127.0.0.1
#Allow 192.168.0.0/16
#Allow 172.16.0.0/12
#Allow 10.0.0.0/8
ConnectPort 443
ConnectPort 563
ConnectPort 8888
ReverseOnly Yes
ReverseBaseURL "http://localhost:8888/"
不要使用tinyproxy,尝试使用Nginx。它非常容易配置。请参阅以下步骤。
安装 Nginx:
在本例中,我使用的是 Ubuntu 16.04,因此我们需要安装 nginx 和 apache2-utils 来创建基本的 HTTP 身份验证帐户。
$ apt update && apt upgrade -y
$ apt install nginx apache2-utils -y
配置 Nginx:我们的主要配置:/etc/nginx/nginx.conf:
/etc/nginx/nginx.conf
> user www-data; worker_processes auto; pid /run/nginx.pid; error_log
> /var/log/nginx/error.log;
>
> events { worker_connections 1024; }
>
> http {
>
> # Basic Settings sendfile on; tcp_nopush on; tcp_nodelay on;
> keepalive_timeout 65; types_hash_max_size 2048;
> server_names_hash_bucket_size 128;
>
> include /etc/nginx/mime.types; default_type
> application/octet-stream;
>
> # Logging Settings
> log_format main '$remote_addr - $remote_user [$time_local] "$request" '
> '$status $body_bytes_sent "$http_referer" '
> '"$http_user_agent" "$http_x_forwarded_for"';
>
> access_log /var/log/nginx/access.log main;
>
> # Gzip Settings gzip on; gzip_disable "msie6";
>
> # Elasticsearch and Kibana Configs include
> /etc/nginx/conf.d/elasticsearch.conf; include
> /etc/nginx/conf.d/kibana.conf; }
我们的/etc/nginx/conf.d/elasticsearch.conf 配置:
/etc/nginx/conf.d/elasticsearch.conf
server {
listen 80;
server_name elasticsearch.domain.com;
# error logging
error_log /var/log/nginx/elasticsearch_error.log;
# authentication: elasticsearch
auth_basic "Elasticsearch Auth";
auth_basic_user_file /etc/nginx/.secrets_elasticsearch;
location / {
proxy_http_version 1.1;
proxy_set_header Host https://search-elasticsearch-name.eu-west-1.es.amazonaws.com;
proxy_set_header X-Real-IP <ELASTIC-IP>;
proxy_set_header Connection "Keep-Alive";
proxy_set_header Proxy-Connection "Keep-Alive";
proxy_set_header Authorization "";
proxy_pass https://search-elasticsearch-name.eu-west-1.es.amazonaws.com/;
proxy_redirect https://search-elasticsearch-name.eu-west-1.es.amazonaws.com/ http://<ELASTIC-IP>/;
}
# ELB Health Checks
location /status {
root /usr/share/nginx/html/;
}
}
为 HTTP 基本身份验证创建用户帐户
在 kibana 和 elasticsearch 上创建 2 个用于身份验证的帐户:
$ htpasswd -c /etc/nginx/.secrets_elasticsearch elasticsearch-admin
$ htpasswd -c /etc/nginx/.secrets_kibana kibana-admin
重新启动 Nginx:
重新启动并在启动时启用 Nginx:
$ systemctl enable nginx
$ systemctl restart nginx