带有Apache2 SSL代理的Elasticsearch

Question

最近，我一直在尝试让Elasticsearch在SSL上可用。这使我处于从apache到nginx到apache到nginx到现在终于回到apache的有趣路线上。

我需要LDAP进行身份验证，这就是为什么我停止使用nginx的原因。我遵循了这个https://gist.github.com/jerrac/0a8bd96e6c42eb84b6f2来配置我的apache网络服务器。好消息是我可以访问它。不好的是，当尝试查找索引时，elasticsearch无法正常工作。我使用elasticsearch-
head来确保它不是其他任何东西，但是即使我可以访问kibana网页，似乎Elasticsearch仍然被阻止。任何帮助，将不胜感激。

<VirtualHost *:80>

ServerAdmin [e-mail]
ServerName logstash.example.com

DocumentRoot /var/www/kibana/
<Directory />
Options FollowSymLinks
AllowOverride None
</Directory>
<Directory /var/www/kibana/>
Options -Indexes FollowSymLinks -MultiViews
AllowOverride all
Order allow,deny
allow from all
</Directory>

 RewriteEngine on
 RewriteCond %{HTTPS} off
 RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
#RewriteRule ^/(.*)$ https://logstash.example.com/$1 [R,L]

 ErrorLog /var/log/apache2/error.log
 CustomLog /var/log/apache2/access.log combined

</VirtualHost>

<IfModule mod_ssl.c>
<VirtualHost *:443>
    ServerAdmin [e-mail]
    ServerName logstash.example.com

  SSLEngine on
  SSLCertificateFile           /etc/ssl/certs/wildcard.example.com.crt
  SSLCertificateKeyFile        /etc/ssl/private/wildcard.example.com.key
  SSLCACertificateFile         /etc/ssl/certs/ca-example.cert
  #RewriteEngine on
  #RewriteCond %{SERVER_NAME} !=logstash.example.com
  #RewriteRule ^/(.*)$ https://logstash.eaxmple.com/$1 [R,L]

 ErrorLog /var/log/apache2/error.log
 CustomLog /var/log/apache2/access.log combined

    DocumentRoot /var/www/kibana/
    <Directory />
            Options FollowSymLinks
            AllowOverride None
    </Directory>
    <Directory /var/www/kibana/>
            Options Indexes FollowSymLinks MultiViews
            AllowOverride None
            Order allow,deny
            allow from all
    </Directory>
    <FilesMatch "\.(cgi|shtml|phtml|php)$">
    SSLOptions +StdEnvVars
</FilesMatch>
<Directory /usr/lib/cgi-bin>
    SSLOptions +StdEnvVars
</Directory>
 BrowserMatch "MSIE [2-6]" \
    nokeepalive ssl-unclean-shutdown \
    downgrade-1.0 force-response-1.0
# MSIE 7 and newer should be able to use keepalive
BrowserMatch "MSIE [7-9]" ssl-unclean-shutdown
#ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
    #<Directory "/usr/lib/cgi-bin">
    #        AllowOverride None
    #        Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
    #        Order allow,deny
    #        Allow from all
    #</Directory>

    ErrorLog ${APACHE_LOG_DIR}/error.log

    # Possible values include: debug, info, notice, warn, error, crit,
    # alert, emerg.
    LogLevel warn

    CustomLog ${APACHE_LOG_DIR}/access.log combined

<Proxy http://127.0.0.1:9200>
 #<Proxy http://logstash.example.com:9200>
        ProxySet connectiontimeout=5 timeout=90
</Proxy>

# Proxy for _aliases and .*/_search
<LocationMatch "^(/_aliases|.*/_search|.*/_mapping|/_nodes)$">
        #ProxyPassMatch http://logstash.example.com:9200
        #ProxyPassReverse http://logstash.example.com:9200
    ProxyPassMatch http://127.0.0.1:9200
        ProxyPassReverse http://127.0.0.1:9200
</LocationMatch>

# Proxy for kibana-int/{dashboard,temp} stuff (if you don't want auth on /, then you will want these to be protected)
<LocationMatch "^(/kibana-int/dashboard/|/kibana-int/temp).*$">
        #ProxyPassMatch http://logstash.example.com:9200
        #ProxyPassReverse http://logstash.example.com:9200
        ProxyPassMatch http://127.0.0.1:9200
        ProxyPassReverse http://127.0.0.1:9200
</LocationMatch>

</VirtualHost>
</IfModule>

Answer 1

https://myserver/index_name/_search/如果Kibana正在运行，您应该能够使用上述配置。

您的LocationMatches只允许很小的信息子集。您可以显式列出索引（例如/index1/.*|/index2/.*），或者提出更灵活的映射（例如，在索引名称中具有已知的模式）。

<LocationMatch "^/(_aliases|index1/.*|index2/.*|_nodes)$">

可能值得注意的是，即使使用SSL暴露Elasticsearch数据库也是非常危险的，因为一旦您允许不受限制的访问，它们就可以从中获取所有数据（以及其他危险操作），这破坏了加密的目的。大部分的流量。