ElasticSearch单机或集群未授权访问漏洞

漏洞处理方法：

1、可以使用体系防火墙

来做限定只答应ES集群和Server节点的IP来访问漏洞节点的9200端口，其他的全部拒绝。
2、在ES节点上设置用户密码

漏洞征象：直接访问9200端口不需要密码验证
修复过程

2.1 生成认证文件

必须要生成认证文件，且ES配置文件里要引用这些生成的认证文件，否则启动ES的时间，日记会报错：Caused by: javax.net.ssl.SSLHandshakeException: No available authentication scheme。
CA 证书

1. [root@node1 elasticsearch-7.6.2]# su es
2. [es@node1 elasticsearch-7.6.2]$ ./bin/elasticsearch-certutil ca
3. This tool assists you in the generation of X.509 certificates and certificate
4. signing requests for use with SSL/TLS in the Elastic stack.
6. The 'ca' mode generates a new 'certificate authority'
7. This will create a new X.509 certificate and private key that can be used
8. to sign certificate when running in 'cert' mode.
10. Use the 'ca-dn' option if you wish to configure the 'distinguished name'
11. of the certificate authority
13. By default the 'ca' mode produces a single PKCS#12 output file which holds:
14.     * The CA certificate
15.     * The CA's private key
17. If you elect to generate PEM format certificates (the -pem option), then the output will
18. be a zip file containing individual files for the CA certificate and private key
20. Please enter the desired output file [elastic-stack-ca.p12]:
21. Enter password for elastic-stack-ca.p12 :

复制代码

2.2 生成p12密钥

使用第一步生成的证书，生成p12秘钥

1. [es@node1 elasticsearch-7.6.2]$ ./bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12
2. This tool assists you in the generation of X.509 certificates and certificate
3. signing requests for use with SSL/TLS in the Elastic stack.
5. The 'cert' mode generates X.509 certificate and private keys.
6.     * By default, this generates a single certificate and key for use
7.        on a single instance.
8.     * The '-multiple' option will prompt you to enter details for multiple
9.        instances and will generate a certificate and key for each one
10.     * The '-in' option allows for the certificate generation to be automated by describing
11.        the details of each instance in a YAML file
13.     * An instance is any piece of the Elastic Stack that requires an SSL certificate.
14.       Depending on your configuration, Elasticsearch, Logstash, Kibana, and Beats
15.       may all require a certificate and private key.
16.     * The minimum required value for each instance is a name. This can simply be the
17.       hostname, which will be used as the Common Name of the certificate. A full
18.       distinguished name may also be used.
19.     * A filename value may be required for each instance. This is necessary when the
20.       name would result in an invalid file or directory name. The name provided here
21.       is used as the directory name (within the zip) and the prefix for the key and
22.       certificate files. The filename is required if you are prompted and the name
23.       is not displayed in the prompt.
24.     * IP addresses and DNS names are optional. Multiple values can be specified as a
25.       comma separated string. If no IP addresses or DNS names are provided, you may
26.       disable hostname verification in your SSL configuration.
28.     * All certificates generated by this tool will be signed by a certificate authority (CA).
29.     * The tool can automatically generate a new CA for you, or you can provide your own with the
30.          -ca or -ca-cert command line options.
32. By default the 'cert' mode produces a single PKCS#12 output file which holds:
33.     * The instance certificate
34.     * The private key for the instance certificate
35.     * The CA certificate
37. If you specify any of the following options:
38.     * -pem (PEM formatted output)
39.     * -keep-ca-key (retain generated CA key)
40.     * -multiple (generate multiple certificates)
41.     * -in (generate certificates from an input file)
42. then the output will be be a zip file containing individual certificate/key files
44. Enter password for CA (elastic-stack-ca.p12) :
46. Please enter the desired output file [elastic-certificates.p12]:
47. Enter password for elastic-certificates.p12 :
49. Certificates written to /home/elasticsearch-7.6.2/elastic-certificates.p12
51. This file should be properly secured as it contains the private key for
52. your instance.
54. This file is a self contained file and can be copied and used 'as is'
55. For each Elastic product that you wish to configure, you should copy
56. this '.p12' file to the relevant configuration directory
57. and then follow the SSL configuration instructions in the product guide.
59. For client applications, you may only need to copy the CA certificate and
60. configure the client to trust this certificate.

复制代码

2.3 将p12认证文件copy到其他节点

1. [es@node1 elasticsearch-7.6.2]$ cd config/
2. [es@node1 config]$ ll
3. total 36
4. -rw-rw---- 1 es es  3284 Dec 14 07:49 elasticsearch.yml
5. -rw-rw---- 1 es es  2301 Mar 26  2020 jvm.options
6. -rw-rw---- 1 es es 17545 Mar 26  2020 log4j2.properties
7. -rw-rw---- 1 es es   473 Mar 26  2020 role_mapping.yml
8. -rw-rw---- 1 es es   197 Mar 26  2020 roles.yml
9. -rw-rw---- 1 es es     0 Mar 26  2020 users
10. -rw-rw---- 1 es es     0 Mar 26  2020 users_roles
11. [es@node1 config]$ mkdir certs
12. [es@node1 config]$ cp ../elastic-certificates.p12 certs/
13. [root@node1 elasticsearch-7.6.2]# scp -r config node2:/home/elasticsearch-7.6.2/
14. log4j2.properties                                                                                100%   17KB  12.2MB/s   00:00   
15. users_roles                                                                                      100%    0     0.0KB/s   00:00   
16. roles.yml                                                                                        100%  197   406.7KB/s   00:00   
17. users                                                                                            100%    0     0.0KB/s   00:00   
18. role_mapping.yml                                                                                 100%  473     1.0MB/s   00:00   
19. elasticsearch.yml                                                                                100% 3284     3.2MB/s   00:00   
20. jvm.options                                                                                      100% 2301     4.4MB/s   00:00   
21. elastic-certificates.p12                                                                         100% 3443     3.1MB/s   00:00   
22. [root@node1 elasticsearch-7.6.2]# scp -r config node3:/home/elasticsearch-7.6.2/
23. log4j2.properties                                                                                100%   17KB  14.6MB/s   00:00   
24. users_roles                                                                                      100%    0     0.0KB/s   00:00   
25. roles.yml                                                                                        100%  197   492.4KB/s   00:00   
26. users                                                                                            100%    0     0.0KB/s   00:00   
27. role_mapping.yml                                                                                 100%  473     1.1MB/s   00:00   
28. elasticsearch.yml                                                                                100% 3284     2.7MB/s   00:00   
29. jvm.options                                                                                      100% 2301     5.0MB/s   00:00   
30. elastic-certificates.p12                                                                         100% 3443     3.9MB/s   00:00   
31. [root@node1 elasticsearch-7.6.2]#

复制代码

2.4 修改所有ES节点配置文件

1. xpack.security.enabled: true
2. xpack.security.transport.ssl.enabled: true
3. xpack.security.transport.ssl.verification_mode: certificate
4. xpack.security.transport.ssl.keystore.path: certs/elastic-certificates.p12
5. xpack.security.transport.ssl.truststore.path: certs/elastic-certificates.p12

复制代码

2.5 启动集群各节点

1. [es@node1 elasticsearch-7.6.2]$ ./bin/elasticsearch -d

复制代码

2.6 主动生成密码

集群也是一台节点生成密码即可

1. [es@node1 elasticsearch-7.6.2]$ ./bin/elasticsearch-setup-passwords auto
2. Initiating the setup of passwords for reserved users elastic,apm_system,kibana,logstash_system,beats_system,remote_monitoring_user.
3. The passwords will be randomly generated and printed to the console.
4. Please confirm that you would like to continue [y/N]y
7. Changed password for user apm_system
8. PASSWORD apm_system = BY8QVLtnyPiIKQKWB9TH
10. Changed password for user kibana
11. PASSWORD kibana = 4MLTzLOC6LGYHkGw0YuW
13. Changed password for user logstash_system
14. PASSWORD logstash_system = GatyQw87IIPPs8dNReSf
16. Changed password for user beats_system
17. PASSWORD beats_system = WsahN3DcIKa4514sxv4n
19. Changed password for user remote_monitoring_user
20. PASSWORD remote_monitoring_user = KBqzFIkgkxytVpswaJW6
22. Changed password for user elastic
23. PASSWORD elastic = ltwcC9q77f0yZMV9CPWl
25. [es@node1 elasticsearch-7.6.2]$

复制代码

3、验证漏洞是否修复乐成

1. [es@node1 elasticsearch-7.6.2]$ curl http://192.168.200.167:9200/_cat/indices?pretty  -u elastic

复制代码

免责声明：如果侵犯了您的权益，请联系站长，我们会及时删除侵权内容，谢谢合作！更多信息从访问主页：qidao123.com:ToB企服之家，中国第一个企服评测及商务社交产业平台。