ssl - 使用 apache2 ssl 代理的 Elasticsearch

Question

最近我一直在尝试让 Elasticsearch 可以通过 SSL 使用。这让我走上了一条从 apache 到 nginx 再到 apache 再到 nginx 的有趣路线，现在终于回到了 apache。

我需要 LDAP 进行身份验证，这就是我停止使用 nginx 的原因。我跟着这个https://gist.github.com/jerrac/0a8bd96e6c42eb84b6f2用于配置我的 Apache Web 服务器。好消息是我能够访问它。不好的是 elasticsearch 在尝试查找索引时不起作用。我使用 elasticsearch-head 来确保它不是其他任何东西，但即使我可以访问 kibana 网页，elasticsearch 似乎仍然被阻止。任何帮助，将不胜感激。

<VirtualHost *:80>

ServerAdmin systems@example.com
ServerName logstash.example.com

DocumentRoot /var/www/kibana/
<Directory />
Options FollowSymLinks
AllowOverride None
</Directory>
<Directory /var/www/kibana/>
Options -Indexes FollowSymLinks -MultiViews
AllowOverride all
Order allow,deny
allow from all
</Directory>

 RewriteEngine on
 RewriteCond %{HTTPS} off
 RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
#RewriteRule ^/(.*)$ https://logstash.example.com/$1 [R,L]

 ErrorLog /var/log/apache2/error.log
 CustomLog /var/log/apache2/access.log combined

</VirtualHost>

<IfModule mod_ssl.c>
<VirtualHost *:443>
    ServerAdmin systems@example.com
    ServerName logstash.example.com

  SSLEngine on
  SSLCertificateFile           /etc/ssl/certs/wildcard.example.com.crt
  SSLCertificateKeyFile        /etc/ssl/private/wildcard.example.com.key
  SSLCACertificateFile         /etc/ssl/certs/ca-example.cert
  #RewriteEngine on
  #RewriteCond %{SERVER_NAME} !=logstash.example.com
  #RewriteRule ^/(.*)$ https://logstash.eaxmple.com/$1 [R,L]

 ErrorLog /var/log/apache2/error.log
 CustomLog /var/log/apache2/access.log combined

    DocumentRoot /var/www/kibana/
    <Directory />
            Options FollowSymLinks
            AllowOverride None
    </Directory>
    <Directory /var/www/kibana/>
            Options Indexes FollowSymLinks MultiViews
            AllowOverride None
            Order allow,deny
            allow from all
    </Directory>
    <FilesMatch "\.(cgi|shtml|phtml|php)$">
    SSLOptions +StdEnvVars
</FilesMatch>
<Directory /usr/lib/cgi-bin>
    SSLOptions +StdEnvVars
</Directory>
 BrowserMatch "MSIE [2-6]" \
    nokeepalive ssl-unclean-shutdown \
    downgrade-1.0 force-response-1.0
# MSIE 7 and newer should be able to use keepalive
BrowserMatch "MSIE [7-9]" ssl-unclean-shutdown
#ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
    #<Directory "/usr/lib/cgi-bin">
    #        AllowOverride None
    #        Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
    #        Order allow,deny
    #        Allow from all
    #</Directory>

    ErrorLog ${APACHE_LOG_DIR}/error.log

    # Possible values include: debug, info, notice, warn, error, crit,
    # alert, emerg.
    LogLevel warn

    CustomLog ${APACHE_LOG_DIR}/access.log combined

<Proxy http://127.0.0.1:9200>
 #<Proxy http://logstash.example.com:9200>
        ProxySet connectiontimeout=5 timeout=90
</Proxy>

# Proxy for _aliases and .*/_search
<LocationMatch "^(/_aliases|.*/_search|.*/_mapping|/_nodes)$">
        #ProxyPassMatch http://logstash.example.com:9200
        #ProxyPassReverse http://logstash.example.com:9200
    ProxyPassMatch http://127.0.0.1:9200
        ProxyPassReverse http://127.0.0.1:9200
</LocationMatch>

# Proxy for kibana-int/{dashboard,temp} stuff (if you don't want auth on /, then you will want these to be protected)
<LocationMatch "^(/kibana-int/dashboard/|/kibana-int/temp).*$">
        #ProxyPassMatch http://logstash.example.com:9200
        #ProxyPassReverse http://logstash.example.com:9200
        ProxyPassMatch http://127.0.0.1:9200
        ProxyPassReverse http://127.0.0.1:9200
</LocationMatch>

</VirtualHost>
</IfModule>

Answer 1

如果 Kibana 正常工作，您应该能够使用上述配置执行 https://myserver/index_name/_search/。

您的 LocationMatches 只允许非常小的信息子集。您可以明确列出您的索引(例如，/index1/.*|/index2/.*)或提出更灵活的映射(例如，在索引名称中有一个已知模式)。

<LocationMatch "^/(_aliases|index1/.*|index2/.*|_nodes)$">

可能值得注意的是，暴露您的 Elasticsearch 数据库是非常危险的，即使它使用 SSL，因为一旦您允许不受限制的访问，它们就可以从中获取所有数据(以及其他有风险的操作)，这会破坏主要目的是对流量进行加密。