When asking questions, please provide the following information:
- Search Guard and Elasticsearch version
SG=6.5.1-24.1
ES=6.5.1
- JVM version and operating system version
JVM=1.8.0_162
OS=Ubuntu 18.04.1 LTS
- Search Guard configuration files
from elastisearch.yml
searchguard.ssl.transport.pemcert_filepath: es-encr-001.pem
searchguard.ssl.transport.pemkey_filepath: es-encr-001.key
searchguard.ssl.transport.pemkey_password: aqTmoD7aBrpX
searchguard.ssl.transport.pemtrustedcas_filepath: root-ca.pem
searchguard.ssl.transport.enforce_hostname_verification: false
searchguard.ssl.transport.resolve_hostname: false
searchguard.ssl.http.enabled: false
searchguard.ssl.http.pemcert_filepath: es-encr-001_http.pem
searchguard.ssl.http.pemkey_filepath: es-encr-001_http.key
searchguard.ssl.http.pemkey_password: raAtcE0mTfuk
searchguard.ssl.http.pemtrustedcas_filepath: root-ca.pem
searchguard.nodes_dn:
-
CN=es-encr-001.XXXX.com,OU=IL,O=Pipl Com, Inc.,DC=XXXX,DC=com
-
CN=es-encr-002.XXXX.com,OU=IL,O=Pipl Com, Inc.,DC=XXXX,DC=com
-
CN=es-encr-003.XXXX.com,OU=IL,O=Pipl Com, Inc.,DC=XXXX,DC=com
searchguard.authcz.admin_dn:
- CN=kirk.XXXX.com,OU=IL,O=XXXX Com, Inc.,DC=XXXX,DC=com
“elasticsearch.yml” 115L, 4129C
- Elasticsearch log messages on debug level
[c.f.s.a.BackendRegistry ] [es-encr-001] Not yet initialized (you may need to run sgadmin)
Hello,
I followed the document for installing SG - https://docs.search-guard.com/latest/search-guard-installation
I have an ES cluster from 3 nodes, generated all the certificates using your TLS tool , and did everything step by step according to the doc.
WARNING: JAVA_HOME not set, will use /usr/bin/java
Search Guard Admin v6
Will connect to localhost:9300 … done
ERR: An unexpected IllegalStateException occured: failed to load plugin class [com.floragunn.searchguard.SearchGuardPlugin]
Trace:
java.lang.IllegalStateException: failed to load plugin class [com.floragunn.searchguard.SearchGuardPlugin]
at org.elasticsearch.plugins.PluginsService.loadPlugin(PluginsService.java:607)
at org.elasticsearch.plugins.PluginsService.<init>(PluginsService.java:112)
at org.elasticsearch.client.transport.TransportClient.newPluginService(TransportClient.java:108)
at org.elasticsearch.client.transport.TransportClient.buildTemplate(TransportClient.java:133)
at org.elasticsearch.client.transport.TransportClient.<init>(TransportClient.java:273)
at com.floragunn.searchguard.tools.SearchGuardAdmin$TransportClientImpl.<init>(SearchGuardAdmin.java:890)
at com.floragunn.searchguard.tools.SearchGuardAdmin.main0(SearchGuardAdmin.java:445)
at com.floragunn.searchguard.tools.SearchGuardAdmin.main(SearchGuardAdmin.java:123)
Caused by: java.lang.reflect.InvocationTargetException
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
at org.elasticsearch.plugins.PluginsService.loadPlugin(PluginsService.java:598)
... 7 more
Caused by: ElasticsearchException[Empty file path for searchguard.ssl.transport.pemkey_filepath]
at com.floragunn.searchguard.ssl.DefaultSearchGuardKeyStore.checkPath(DefaultSearchGuardKeyStore.java:800)
at com.floragunn.searchguard.ssl.DefaultSearchGuardKeyStore.resolve(DefaultSearchGuardKeyStore.java:210)
at com.floragunn.searchguard.ssl.DefaultSearchGuardKeyStore.initSSLConfig(DefaultSearchGuardKeyStore.java:327)
at com.floragunn.searchguard.ssl.DefaultSearchGuardKeyStore.<init>(DefaultSearchGuardKeyStore.java:151)
at com.floragunn.searchguard.ssl.SearchGuardSSLPlugin.<init>(SearchGuardSSLPlugin.java:193)
at com.floragunn.searchguard.SearchGuardPlugin.<init>(SearchGuardPlugin.java:212)
... 12 more
It says that “Empty file path for searchguard.ssl.transport.pemkey_filepath”, but I do use the -keypass inside the command.
Now, when I want to initialize the SG, I run the next command -
/usr/share/elasticsearch/plugins/search-guard-6/tools/sgadmin.sh -cd /usr/share/elasticsearch/plugins/search-guard-6/sgconfig/ -icl -nhnv -cacert /etc/elasticsearch/root-ca.pem -cert /etc/elasticsearch/kirk.pem -keypass aqTmoD7aBrpX --ignore-clustername
And receiving the following error -
Can you advice please?
Thanks,
Aleksei