使用apache2 ssl代理的Elasticsearch

最近我一直在尝试让Elasticsearch可以通过SSL使用。这让我走上了一条有趣的路线，从apache到nginx，再到apache到ginnx，最后又回到了apache。

我需要LDAP进行身份验证，这就是我停止使用nginx的原因。我遵循了这个https://gist.github.com/jerrac/0a8bd96e6c42eb84b6f2用于配置我的apacheweb服务器。好的是我可以访问它。坏的是，当试图寻找索引时，弹性搜索不起作用。我使用弹性搜索头来确保它不是其他东西，但即使我可以访问kibana网页，弹性搜索似乎仍被屏蔽。如有任何帮助，我们将不胜感激。

<VirtualHost *:80>
ServerAdmin systems@example.com
ServerName logstash.example.com
DocumentRoot /var/www/kibana/
<Directory />
Options FollowSymLinks
AllowOverride None
</Directory>
<Directory /var/www/kibana/>
Options -Indexes FollowSymLinks -MultiViews
AllowOverride all
Order allow,deny
allow from all
</Directory>
 RewriteEngine on
 RewriteCond %{HTTPS} off
 RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
#RewriteRule ^/(.*)$ https://logstash.example.com/$1 [R,L]
 ErrorLog /var/log/apache2/error.log
 CustomLog /var/log/apache2/access.log combined
</VirtualHost>
<IfModule mod_ssl.c>
<VirtualHost *:443>
    ServerAdmin systems@example.com
    ServerName logstash.example.com
  SSLEngine on
  SSLCertificateFile           /etc/ssl/certs/wildcard.example.com.crt
  SSLCertificateKeyFile        /etc/ssl/private/wildcard.example.com.key
  SSLCACertificateFile         /etc/ssl/certs/ca-example.cert
  #RewriteEngine on
  #RewriteCond %{SERVER_NAME} !=logstash.example.com
  #RewriteRule ^/(.*)$ https://logstash.eaxmple.com/$1 [R,L]
 ErrorLog /var/log/apache2/error.log
 CustomLog /var/log/apache2/access.log combined
    DocumentRoot /var/www/kibana/
    <Directory />
            Options FollowSymLinks
            AllowOverride None
    </Directory>
    <Directory /var/www/kibana/>
            Options Indexes FollowSymLinks MultiViews
            AllowOverride None
            Order allow,deny
            allow from all
    </Directory>
    <FilesMatch ".(cgi|shtml|phtml|php)$">
    SSLOptions +StdEnvVars
</FilesMatch>
<Directory /usr/lib/cgi-bin>
    SSLOptions +StdEnvVars
</Directory>
 BrowserMatch "MSIE [2-6]" 
    nokeepalive ssl-unclean-shutdown 
    downgrade-1.0 force-response-1.0
# MSIE 7 and newer should be able to use keepalive
BrowserMatch "MSIE [7-9]" ssl-unclean-shutdown
#ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
    #<Directory "/usr/lib/cgi-bin">
    #        AllowOverride None
    #        Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
    #        Order allow,deny
    #        Allow from all
    #</Directory>
    ErrorLog ${APACHE_LOG_DIR}/error.log
    # Possible values include: debug, info, notice, warn, error, crit,
    # alert, emerg.
    LogLevel warn
    CustomLog ${APACHE_LOG_DIR}/access.log combined
<Proxy http://127.0.0.1:9200>
 #<Proxy http://logstash.example.com:9200>
        ProxySet connectiontimeout=5 timeout=90
</Proxy>
# Proxy for _aliases and .*/_search
<LocationMatch "^(/_aliases|.*/_search|.*/_mapping|/_nodes)$">
        #ProxyPassMatch http://logstash.example.com:9200
        #ProxyPassReverse http://logstash.example.com:9200
    ProxyPassMatch http://127.0.0.1:9200
        ProxyPassReverse http://127.0.0.1:9200
</LocationMatch>
# Proxy for kibana-int/{dashboard,temp} stuff (if you don't want auth on /, then you will want these to be protected)
<LocationMatch "^(/kibana-int/dashboard/|/kibana-int/temp).*$">
        #ProxyPassMatch http://logstash.example.com:9200
        #ProxyPassReverse http://logstash.example.com:9200
        ProxyPassMatch http://127.0.0.1:9200
        ProxyPassReverse http://127.0.0.1:9200
</LocationMatch>
</VirtualHost>
</IfModule>

如果Kibana工作，您应该能够使用上述配置执行https://myserver/index_name/_search/。

您的LocationMatch只允许非常小的信息子集。您可以显式列出索引（例如，/index1/.*|/index2/.*），也可以提出更灵活的映射（例如，在索引的名称中有一个已知的模式）。

<LocationMatch "^/(_aliases|index1/.*|index2/.*|_nodes)$">

值得注意的是，即使Elasticsearch数据库使用SSL，公开它也是非常危险的，因为一旦你允许不受限制的访问，他们就可以从中获取所有数据（以及其他风险操作），这在很大程度上违背了加密流量的目的。

相关内容

最新更新

热门标签：