- [Elasticsearch logfiles on debug level]
[2019-12-24T20:52:49,167][WARN ][o.e.h.AbstractHttpServerTransport] [kibana-centos-7] caught exception while handling client http traffic, closing connection Netty4HttpChannel{localAddress=/127.0.0.1:9200, remoteAddress=/127.0.0.1:41534}
io.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:473) ~[netty-codec-4.1.43.Final.jar:4.1.43.Final]
at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:281) ~[netty-codec-4.1.43.Final.jar:4.1.43.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:374) [netty-transport-4.1.43.Final.jar:4.1.43.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:360) [netty-transport-4.1.43.Final.jar:4.1.43.Final]
at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:352) [netty-transport-4.1.43.Final.jar:4.1.43.Final]
at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1422) [netty-transport-4.1.43.Final.jar:4.1.43.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:374) [netty-transport-4.1.43.Final.jar:4.1.43.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:360) [netty-transport-4.1.43.Final.jar:4.1.43.Final]
at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:931) [netty-transport-4.1.43.Final.jar:4.1.43.Final]
at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:163) [netty-transport-4.1.43.Final.jar:4.1.43.Final]
at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:700) [netty-transport-4.1.43.Final.jar:4.1.43.Final]
at io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:600) [netty-transport-4.1.43.Final.jar:4.1.43.Final]
at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:554) [netty-transport-4.1.43.Final.jar:4.1.43.Final]
at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:514) [netty-transport-4.1.43.Final.jar:4.1.43.Final]
at io.netty.util.concurrent.SingleThreadEventExecutor$6.run(SingleThreadEventExecutor.java:1050) [netty-common-4.1.43.Final.jar:4.1.43.Final]
at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74) [netty-common-4.1.43.Final.jar:4.1.43.Final]
at java.lang.Thread.run(Thread.java:830) [?:?]
Caused by: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.ssl.Alert.createSSLException(Alert.java:131) ~[?:?]
at sun.security.ssl.TransportContext.fatal(TransportContext.java:324) ~[?:?]
at sun.security.ssl.TransportContext.fatal(TransportContext.java:267) ~[?:?]
at sun.security.ssl.TransportContext.fatal(TransportContext.java:262) ~[?:?]
at sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkClientCerts(CertificateMessage.java:687) ~[?:?]
at sun.security.ssl.CertificateMessage$T12CertificateConsumer.onCertificate(CertificateMessage.java:398) ~[?:?]
at sun.security.ssl.CertificateMessage$T12CertificateConsumer.consume(CertificateMessage.java:366) ~[?:?]
at sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:396) ~[?:?]
at sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:444) ~[?:?]
at sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1260) ~[?:?]
at sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1247) ~[?:?]
at java.security.AccessController.doPrivileged(AccessController.java:691) ~[?:?]
at sun.security.ssl.SSLEngineImpl$DelegatedTask.run(SSLEngineImpl.java:1192) ~[?:?]
at io.netty.handler.ssl.SslHandler.runAllDelegatedTasks(SslHandler.java:1502) ~[netty-handler-4.1.43.Final.jar:4.1.43.Final]
at io.netty.handler.ssl.SslHandler.runDelegatedTasks(SslHandler.java:1516) ~[netty-handler-4.1.43.Final.jar:4.1.43.Final]
at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1400) ~[netty-handler-4.1.43.Final.jar:4.1.43.Final]
at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1227) ~[netty-handler-4.1.43.Final.jar:4.1.43.Final]
at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1274) ~[netty-handler-4.1.43.Final.jar:4.1.43.Final]
at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:503) ~[netty-codec-4.1.43.Final.jar:4.1.43.Final]
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:442) ~[netty-codec-4.1.43.Final.jar:4.1.43.Final]
... 16 more
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:384) ~[?:?]
at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:289) ~[?:?]
at sun.security.validator.Validator.validate(Validator.java:264) ~[?:?]
at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:285) ~[?:?]
at sun.security.ssl.X509TrustManagerImpl.checkClientTrusted(X509TrustManagerImpl.java:138) ~[?:?]
at sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkClientCerts(CertificateMessage.java:669) ~[?:?]
at sun.security.ssl.CertificateMessage$T12CertificateConsumer.onCertificate(CertificateMessage.java:398) ~[?:?]
at sun.security.ssl.CertificateMessage$T12CertificateConsumer.consume(CertificateMessage.java:366) ~[?:?]
at sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:396) ~[?:?]
at sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:444) ~[?:?]
at sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1260) ~[?:?]
at sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1247) ~[?:?]
at java.security.AccessController.doPrivileged(AccessController.java:691) ~[?:?]
at sun.security.ssl.SSLEngineImpl$DelegatedTask.run(SSLEngineImpl.java:1192) ~[?:?]
at io.netty.handler.ssl.SslHandler.runAllDelegatedTasks(SslHandler.java:1502) ~[netty-handler-4.1.43.Final.jar:4.1.43.Final]
at io.netty.handler.ssl.SslHandler.runDelegatedTasks(SslHandler.java:1516) ~[netty-handler-4.1.43.Final.jar:4.1.43.Final]
at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1400) ~[netty-handler-4.1.43.Final.jar:4.1.43.Final]
at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1227) ~[netty-handler-4.1.43.Final.jar:4.1.43.Final]
at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1274) ~[netty-handler-4.1.43.Final.jar:4.1.43.Final]
at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:503) ~[netty-codec-4.1.43.Final.jar:4.1.43.Final]
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:442) ~[netty-codec-4.1.43.Final.jar:4.1.43.Final]
... 16 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141) ~[?:?]
at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126) ~[?:?]
at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:297) ~[?:?]
at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:379) ~[?:?]
at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:289) ~[?:?]
at sun.security.validator.Validator.validate(Validator.java:264) ~[?:?]
at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:285) ~[?:?]
at sun.security.ssl.X509TrustManagerImpl.checkClientTrusted(X509TrustManagerImpl.java:138) ~[?:?]
at sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkClientCerts(CertificateMessage.java:669) ~[?:?]
at sun.security.ssl.CertificateMessage$T12CertificateConsumer.onCertificate(CertificateMessage.java:398) ~[?:?]
at sun.security.ssl.CertificateMessage$T12CertificateConsumer.consume(CertificateMessage.java:366) ~[?:?]
at sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:396) ~[?:?]
at sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:444) ~[?:?]
at sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1260) ~[?:?]
at sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1247) ~[?:?]
at java.security.AccessController.doPrivileged(AccessController.java:691) ~[?:?]
at sun.security.ssl.SSLEngineImpl$DelegatedTask.run(SSLEngineImpl.java:1192) ~[?:?]
at io.netty.handler.ssl.SslHandler.runAllDelegatedTasks(SslHandler.java:1502) ~[netty-handler-4.1.43.Final.jar:4.1.43.Final]
at io.netty.handler.ssl.SslHandler.runDelegatedTasks(SslHandler.java:1516) ~[netty-handler-4.1.43.Final.jar:4.1.43.Final]
at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1400) ~[netty-handler-4.1.43.Final.jar:4.1.43.Final]
at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1227) ~[netty-handler-4.1.43.Final.jar:4.1.43.Final]
at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1274) ~[netty-handler-4.1.43.Final.jar:4.1.43.Final]
at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:503) ~[netty-codec-4.1.43.Final.jar:4.1.43.Final]
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:442) ~[netty-codec-4.1.43.Final.jar:4.1.43.Final]
... 16 more
- Your Search Guard configuration files
[root@kibana-centos-7 ~]# cat /usr/share/elasticsearch/plugins/search-guard-7/sgconfig/sg_config.yml
# Generated by chef
#
---
_sg_meta:
type: config
config_version: '2'
sg_config:
dynamic:
http:
anonymous_auth_enabled: false
xff:
enabled: true
internalProxies: ".*"
remoteIpHeader: x-forwarded-for
authc:
proxy_auth_domain:
http_enabled: true
order: 0
http_authenticator:
challenge: false
config:
user_header: x-proxy-user
roles_header: x-proxy-roles
authentication_backend:
type: noop
basic_internal_auth_domain:
order: 1
http_authenticator:
challenge: true
- Your elasticsearch.yml configuration file
[root@kibana-centos-7 ~]# cat /etc/elasticsearch/elasticsearch.yml
# Generated by chef
#
---
cluster:
name: es_test
routing:
allocation:
allow_rebalance: always
disk:
watermark:
low: 90%
high: 95%
initial_master_nodes: 127.0.0.1
path:
data: "/data"
logs: "/var/log/elasticsearch/"
network:
host: 127.0.0.1
http:
port: '9200'
xpack:
ml:
enabled: false
monitoring:
enabled: true
collection:
enabled: true
graph:
enabled: true
watcher:
enabled: true
security:
enabled: false
http:
ssl:
verification_mode: none
discovery:
seed_hosts: localhost
zen:
minimum_master_nodes: 1
node:
name: kibana-centos-7
master: true
data: true
ingest: true
searchguard:
restapi:
roles_enabled:
- SGS_ALL_ACCESS
ssl:
transport:
pemcert_filepath: x-pack/elasticsearch.crt
pemkey_filepath: x-pack/elasticsearch.key
pemtrustedcas_filepath: x-pack/ca.crt
enforce_hostname_verification: false
resolve_hostname: false
http:
enabled: true
pemcert_filepath: x-pack/elasticsearch.crt
pemkey_filepath: x-pack/elasticsearch.key
pemtrustedcas_filepath: x-pack/ca.crt
enterprise_modules_enabled: false
enable_snapshot_restore_privilege: true
authcz:
admin_dn:
- CN=admin.elastictest.com,OU=Ops,O=elastictest Com\, Inc.,DC=elastictest,DC=com
gateway:
expected_master_nodes: 1
- Your kibana.yml configuration file
[root@kibana-centos-7 ~]# cat /etc/kibana/kibana.yml
# Generated by chef
#
---
server:
host: 0.0.0.0
ssl:
enabled: true
key: "/etc/kibana/kibana.key"
certificate: "/etc/kibana/kibana.crt"
elasticsearch:
username: kibanaserver
password: kibanaserver
ssl:
certificateAuthorities: "/etc/kibana/ca.crt"
key: "/etc/kibana/kibana.key"
certificate: "/etc/kibana/kibana.crt"
verificationMode: none
hosts: https://localhost:9200
requestHeadersWhitelist:
- authorization
- x-forwarded-for
- x-forwarded-by
- x-proxy-user
- x-proxy-roles
xpack:
security:
enabled: false
monitoring:
enabled: true
graph:
enabled: true
spaces:
enabled: false
infra:
enabled: false
reporting:
enabled: true
encryptionKey: bbySecureCloud
csv:
maxSizeBytes: '20971520'
kibanaServer:
port: '5601'
protocol: https
logging:
dest: "/var/log/kibana/kibana.log"
verbose: false
pid:
file: "/var/run/kibana/kibana.pid"
searchguard:
allow_client_certificates: true
auth:
type: basicauth
cookie:
secure: true
password: somerandolongpasswordwithmorethanthirtytwocharactersinit
What I observe below is that there is a successful sgadmin executed, however curl only works when I pass it the certs/keys. There is a ‘troubleshooting tls’ page in SG that talks about Fixing Curl and that seems to suggest that NSS compiled curl (which ships with CentOS7) needs to be replaced with an updated OpenSSL compiled curl.
- Initialize SG:
[root@kibana-centos-7 ~]# /usr/share/elasticsearch/plugins/search-guard-7/tools/sgadmin.sh -h '127.0.0.1' -cd '/usr/share/elasticsearch/plugins/search-guard-7/sgconfig' -icl -nhnv -key /etc/elasticsearch/kirk.key -cert /etc/elasticsearch/kirk.crt -cacert /etc/elasticsearch/x-pack/ca.crt
WARNING: JAVA_HOME not set, will use /bin/java
Search Guard Admin v7
Will connect to 127.0.0.1:9300 ... done
Connected as CN=admin.elastictest.com,OU=Ops,O=elastictest Com\, Inc.,DC=elastictest,DC=com
Elasticsearch Version: 7.5.0
Search Guard Version: 7.5.0-37.1.0
Contacting elasticsearch cluster 'elasticsearch' and wait for YELLOW clusterstate ...
Clustername: es_test
Clusterstate: GREEN
Number of nodes: 1
Number of data nodes: 1
searchguard index already exists, so we do not need to create one.
Populate config from /usr/share/elasticsearch/plugins/search-guard-7/sgconfig/
/usr/share/elasticsearch/plugins/search-guard-7/sgconfig/sg_action_groups.yml OK
/usr/share/elasticsearch/plugins/search-guard-7/sgconfig/sg_internal_users.yml OK
/usr/share/elasticsearch/plugins/search-guard-7/sgconfig/sg_roles.yml OK
/usr/share/elasticsearch/plugins/search-guard-7/sgconfig/sg_roles_mapping.yml OK
/usr/share/elasticsearch/plugins/search-guard-7/sgconfig/sg_config.yml OK
/usr/share/elasticsearch/plugins/search-guard-7/sgconfig/sg_tenants.yml OK
Will update '_doc/config' with /usr/share/elasticsearch/plugins/search-guard-7/sgconfig/sg_config.yml
SUCC: Configuration for 'config' created or updated
Will update '_doc/roles' with /usr/share/elasticsearch/plugins/search-guard-7/sgconfig/sg_roles.yml
SUCC: Configuration for 'roles' created or updated
Will update '_doc/rolesmapping' with /usr/share/elasticsearch/plugins/search-guard-7/sgconfig/sg_roles_mapping.yml
SUCC: Configuration for 'rolesmapping' created or updated
Will update '_doc/internalusers' with /usr/share/elasticsearch/plugins/search-guard-7/sgconfig/sg_internal_users.yml
SUCC: Configuration for 'internalusers' created or updated
Will update '_doc/actiongroups' with /usr/share/elasticsearch/plugins/search-guard-7/sgconfig/sg_action_groups.yml
SUCC: Configuration for 'actiongroups' created or updated
Will update '_doc/tenants' with /usr/share/elasticsearch/plugins/search-guard-7/sgconfig/sg_tenants.yml
SUCC: Configuration for 'tenants' created or updated
Done with success
- Default curl:
[root@kibana-centos-7 ~]# curl -V
curl 7.29.0 (x86_64-redhat-linux-gnu) libcurl/7.29.0 NSS/3.36 zlib/1.2.7 libidn/1.28 libssh2/1.4.3
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp scp sftp smtp smtps telnet tftp
Features: AsynchDNS GSS-Negotiate IDN IPv6 Largefile NTLM NTLM_WB SSL libz unix-sockets
- Default curl does not work:
[root@kibana-centos-7 ~]# curl -k https://admin:<password>@localhost:9200/
Search Guard not initialized (SG11). See https://docs.search-guard.com/latest/sgadmin
- Default curl works when I pass the --cert and --key values:
[root@kibana-centos-7 ~]# curl -k --cert /etc/elasticsearch/kirk.crt --key /etc/elasticsearch/kirk.key https://localhost:9200
{
"name" : "kibana-centos-7",
"cluster_name" : "es_test",
"cluster_uuid" : "aiP-f8lxQsiZBtKrkbW4Ow",
"version" : {
"number" : "7.5.0",
"build_flavor" : "default",
"build_type" : "rpm",
"build_hash" : "e9ccaed468e2fac2275a3761849cbee64b39519f",
"build_date" : "2019-11-26T01:06:52.518245Z",
"build_snapshot" : false,
"lucene_version" : "8.3.0",
"minimum_wire_compatibility_version" : "6.8.0",
"minimum_index_compatibility_version" : "6.0.0-beta1"
},
"tagline" : "You Know, for Search"
}
- Output of
yum info libcurlshows that the CentOS7 package only has release updates available, and not the versions as suggested in the wiki
[root@kibana-centos-7 ~]# yum info libcurl
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
* centos-sclo-rh: mirrors.usinternet.com
* centos-sclo-sclo: mirrors.usinternet.com
Installed Packages
Name : libcurl
Arch : x86_64
Version : 7.29.0
Release : 51.el7_6.3
Size : 425 k
Repo : installed
From repo : centos-7-update-rpms
Summary : A library for getting files from web servers
URL : http://curl.haxx.se/
License : MIT
Description : libcurl is a free and easy-to-use client-side URL transfer library, supporting
: FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMAP,
: SMTP, POP3 and RTSP. libcurl supports SSL certificates, HTTP POST, HTTP PUT,
: FTP uploading, HTTP form based upload, proxies, cookies, user+password
: authentication (Basic, Digest, NTLM, Negotiate, Kerberos4), file transfer
: resume, http proxy tunneling and more.
Available Packages
Name : libcurl
Arch : i686
Version : 7.29.0
Release : 54.el7
Size : 225 k
Repo : centos-7-server-rpms
Summary : A library for getting files from web servers
URL : http://curl.haxx.se/
License : MIT
Description : libcurl is a free and easy-to-use client-side URL transfer library, supporting
: FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMAP,
: SMTP, POP3 and RTSP. libcurl supports SSL certificates, HTTP POST, HTTP PUT,
#!/bin/sh
: FTP uploading, HTTP form based upload, proxies, cookies, user+password
: authentication (Basic, Digest, NTLM, Negotiate, Kerberos4), file transfer
: resume, http proxy tunneling and more.
Name : libcurl
Arch : x86_64
Version : 7.29.0
Release : 54.el7
Size : 222 k
Repo : centos-7-server-rpms
Summary : A library for getting files from web servers
URL : http://curl.haxx.se/
License : MIT
Description : libcurl is a free and easy-to-use client-side URL transfer library, supporting
: FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMAP,
: SMTP, POP3 and RTSP. libcurl supports SSL certificates, HTTP POST, HTTP PUT,
: FTP uploading, HTTP form based upload, proxies, cookies, user+password
: authentication (Basic, Digest, NTLM, Negotiate, Kerberos4), file transfer
: resume, http proxy tunneling and more.
- Compile and install libcurl to satisfy the Openssl and 7.50 requirements:
curl -O https://curl.haxx.se/download/curl-7.58.0.tar.bz2
tar xvf curl-7.58.0.tar.bz2
cd curl-7.58.0
./configure --with-ssl
make
make install
[root@kibana-centos-7 curl-7.58.0]# /usr/local/bin/curl -V
curl 7.58.0 (x86_64-pc-linux-gnu) libcurl/7.58.0 OpenSSL/1.0.2k zlib/1.2.7
Release-Date: 2018-01-24
Protocols: dict file ftp ftps gopher http https imap imaps pop3 pop3s rtsp smb smbs smtp smtps telnet tftp
Features: AsynchDNS IPv6 Largefile NTLM NTLM_WB SSL libz UnixSockets HTTPS-proxy
- Test curl against SG:
[root@kibana-centos-7 curl-7.58.0]# /usr/local/bin/curl -k https://localhost:9200
Search Guard not initialized (SG11). See https://docs.search-guard.com/latest/sgadmin
- Test curl against SG with --cert and --key:
[root@kibana-centos-7 curl-7.58.0]# curl -k --cert /etc/elasticsearch/kirk.crt --key /etc/elasticsearch/kirk.key https://localhost:9200/
{
"name" : "kibana-centos-7",
"cluster_name" : "es_test",
"cluster_uuid" : "oT8hBHRwQF271HphJvpkzQ",
"version" : {
"number" : "7.5.0",
"build_flavor" : "default",
"build_type" : "rpm",
"build_hash" : "e9ccaed468e2fac2275a3761849cbee64b39519f",
"build_date" : "2019-11-26T01:06:52.518245Z",
"build_snapshot" : false,
"lucene_version" : "8.3.0",
"minimum_wire_compatibility_version" : "6.8.0",
"minimum_index_compatibility_version" : "6.0.0-beta1"
},
"tagline" : "You Know, for Search"
}
- Output of kibana.log:
{"type":"log","@timestamp":"2019-12-24T21:07:30Z","tags":["warning","elasticsearch","admin"],"pid":14166,"message":"Unable to revive connection: https://localhost:9200/"}
{"type":"log","@timestamp":"2019-12-24T21:07:30Z","tags":["warning","elasticsearch","admin"],"pid":14166,"message":"No living connections"}
{"type":"log","@timestamp":"2019-12-24T21:07:32Z","tags":["warning","elasticsearch","admin"],"pid":14166,"message":"Unable to revive connection: https://localhost:9200/"}
{"type":"log","@timestamp":"2019-12-24T21:07:32Z","tags":["warning","elasticsearch","admin"],"pid":14166,"message":"No living connections"}
Question is “how do I get Search Guard to initialize successfully”? The sgadmin.sh script appears to exit successfully, and it also appears that the updated curl package has the correct Openssl after compiling. Why do the curl statements not agree with the sgadmin output?