Installing SG Plugin in ELK7.17.3 on Windows , ELK Nodes are not working after installing SG

Search Guard
41

@AKCG12 I’ve forgotten that you’re using Windows. I think there is a Windows version of the openssl tool. The sgtlsdiag.bat is enough too.
According to your sgtlsdiag.bat output, the node2.pem has no certificate path which means that is self-signed and is not signed by the root ca HAL-CA.cer.

At this point, you should contact your team that signed your cert and verify the signing process with them.

This is how it should look like.

image
image997×461 14.3 KB

As long as this trust is not present, the cluster won’t work and sgadmin.sh will also fail.

Please be aware that the SSL certificate, used with sgadmin.sh script, must be also signed by the same root CA as node certificates.

42

Hi Pablo,

I got the node cert signed in by the Root certs. but my Root cert is like root.ca → root1.ca . there is a trust between the root1.ca and the node cert .
In this case what should i input in my elasticsearch.yml file. is there a option to have two certs to be inputted in the yml file .

43

@AKCG12 Yes, you can have two certificates, but in this case, I’d suggest replacing HAL-CA.cer with that Root certificate. That change must be made in all Elasticsearch nodes in the cluster.

44

hi Pablo,
so in the elastic searchyml file how could i mention two files as root ca .

searchguard.ssl.transport.pemtrustedcas_filepath: HAL-CA-1.cer, HAL -CA.cer

will this be the correct way

45

@AKCG12 Have you tried to use just the correct one? Try to get the Elasticsearch cluster up and running and then test multiple root CA certificates.

To configure multiple root CAs, you’ll have to place them both in one file. Just copy and paste the content of both certificates.
However, for testing purposes, I strongly suggest using a single root CA that has trust with the node certificate and testing the cluster functionality.

46

Hi Pablo,

I tried running the elk , it is trying to form the cluster- it says to Node3 not initialized… need to run the sg admin tool
when i run the sgadmin tool this is the error i am getting .

image
image1750×583 180 KB

47

Hi Pablo,

I have a 3 node cluster and my Admin certificate i generated is node4 - which is a Kibana server. While i am running the sg admin command from one of the 3 nodes of ELK.

Hope i am doing it correctly … this is my command to run the SG Admin.bat

.\sgadmin.bat -cd D:\ELK\elasticsearch-7.17.3-windows-x86_64\elasticsearch-7.17.3\plugins\search-guard-7\sgconfig -icl -key D:\ELK\elasticsearch-7.17.3-windows-x86_64\elasticsearch-7.17.3\config\node4.key -cert D:\ELK\elasticsearch-7.17.3-windows-x86_64\elasticsearch-7.17.3\config\node4.pem -cacert D:\ELK\elasticsearch-7.17.3-windows-x86_64\elasticsearch-7.17.3\config\xx-CA-1.pem -nhnv -h xxxxx.com

48

Hi Pablo,

I was able to resolve the PEM Key error, with the wrong password. Now i dont get the transaport layer ssl issues. while i run the SG Admin command , i get the following errors. Do i need to run the SGADMIN Command in every node(3 nodes) and i am getting a lot of JVM Crash happening … when i start the cluster and when the SGADMIN is initializing the sgadmin index

49

image
image1852×666 267 KB

50

image
image1800×643 286 KB

image
image1839×678 279 KB

51

@amalk12 These are not JVM crash errors but only warnings. The SG plugin is not initialized yet and you need to run sgadmin.sh to create searchguard index and add plugin configuration.

I assume you’ve used the below command to initialize SG plugin.

.\sgadmin.bat -cd D:\ELK\elasticsearch-7.17.3-windows-x86_64\elasticsearch-7.17.3\plugins\search-guard-7\sgconfig -icl -key D:\ELK\elasticsearch-7.17.3-windows-x86_64\elasticsearch-7.17.3\config\node4.key -cert D:\ELK\elasticsearch-7.17.3-windows-x86_64\elasticsearch-7.17.3\config\node4.pem -cacert D:\ELK\elasticsearch-7.17.3-windows-x86_64\elasticsearch-7.17.3\config\xx-CA-1.pem -nhnv -h [xxxxx.com](http://xxxxx.com/)

If so, then as per my previous comment

Are the xx-CA-1.pem and certificate configured in searchguard.ssl.transport.pemtrustedcas_filepath in elasticsearch.yml the same certificates?

Does certificate used with sgadmin.sh script has the same CN/SAN as configured in the elasticsearch.yml?

searchguard.authcz.admin_dn:

  - CN=LXX,OU=ID,O=HA,L=baa, C=com
52

Yes, the node4 certificate and HAL-CA-1.pem file has trust established. and in the elasticsearch .yml in the elk clusternodes.

i have given node4 as the Admin node.

My question is do i need to run the sgadmin.sh command in every node of the elk cluster. or should i just run in one node and it should be fine

53

@amalk12 Try adding the content of HAL-CA-1.pem to the file defined in

plugins.security.ssl.transport.pemtrustedcas_filepath:

After adding that cert, it should be similar to this example.

image
image524×739 47.2 KB

54

Hi Pablo,

Every time i try to start the cluster, the node runs for sometime and then the high heap memory usage error comes up and the node is crashing and is shut down. I am not sure why this java heap usage high is coming up while cluster is getting formed

image
image1740×780 205 KB

55

image
image1885×681 272 KB

image
image1861×684 247 KB

56

Hi Pablo,
is my cluster getting formed… i am not sure about that. i do get node2 not initialized or node3 not initialized . can you plz throw some light on this issue

57

Hi Pablo,
I am able to get the cluster formed and i am able to initialize the index using sgadmin.bat command. I have installed the kibana plugin also.

it looks like data is not following in from elk servers to kibana. i do have the logstash also.
so is there any config changes need to be done in kibana and logstash after the search guard is initialized in elk cluster

Thanks for all your help

58

@amalk12 There is no data flow between Elasticsearch and Kibana. Data are stored in the Elasticsearch indices and Kibana only accesses them through APIs.

If you can’t see data in the logstash indices I suggest reviewing your logstash config and following this documentation.

59

Hi Pablo,

Thanks for all the help, Issue is resolved. The data is flowing from Logstash to ELK cluster and then to Kibana.

Have a good day. Thank you
AK

60

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.