当前位置：首页 > news >正文

ES_如何设置ElasticSearch 8.0版本的匿名访问以及https_http模式的互相切换

news 2025/7/18 2:27:58

总结：
设置匿名访问，只需要设置xpack.security.authc.anonymous.username和xpack.security.authc.anonymous.roles参数就行，设置好后，可以匿名访问也可以非匿名访问，但是非匿名访问的情况下必须保证用户名和密码正确
取消https模式即取消TLS只用http的情况下，必须xpack.security.enabled和xpack.security.http.ssl.enabled和xpack.security.transport.ssl.enabled三个参数一起设置为false，这种模式下，不管是否设置匿名访问，都可以匿名访问，也可以非匿名访问并且用户名和密码错误也可以访问，也就是说取消https模式即取消TLS只用http的情况下，是完全的不要认证更不会管是否匿名访问还是不匿名访问了

ES如果直接不需要输入账号密码就能实现curl查询集群状态的话，那么可以使用设置匿名访问的方式，在三个节点上的/etc/elasticsearch/elasticsearch.yml设置下面2个参数，以实现匿名访问
xpack.security.authc.anonymous.username: anonymous_user
The username (principal) of the anonymous user. Defaults to _es_anonymous_user.
匿名用户的用户名(主体)

xpack.security.authc.anonymous.roles: superuser
The roles to associate with the anonymous user. Required.
与匿名用户关联的角色。必需的。

下面3个参数设置与否对匿名访问没有影响
xpack.security.authc.token.enabled: false
Set to false to disable the built-in token service. Defaults to true unless xpack.security.http.ssl.enabled is false. This prevents sniffing the token from a connection over plain http.
设置为 false 以禁用内置令牌服务。默认为 true，除非 xpack.security.http.ssl.enabled 为 false。这可以防止通过普通http连接嗅探令牌

xpack.security.http.ssl.client_authentication
Controls the server’s behavior in regard to requesting a certificate from client connections. Valid values are required, optional, and none. required forces a client to present a certificate, while optional requests a client certificate but the client is not required to present one. Defaults to none.
控制服务器在从客户端连接请求证书方面的行为。有效值是必需的、可选的和无。必需的强制客户端提供证书，而可选的则请求客户端证书但不要求客户端提供证书。默认为无。
–这个参数不是说配置为none就是客户端浏览器不用输入账号密码就能访问，而是说客户端浏览器访问服务器web时，服务器web端是否也需要客户端浏览器提供证书才能允许客户端浏览器连接服务器web端，就类似网银一样客户端那边的浏览器需要安装控件什么的才能正常访问银行网站。

xpack.security.authc.anonymous.authz_exception
When true, an HTTP 403 response is returned if the anonymous user does not have the appropriate permissions for the requested action. The user is not prompted to provide credentials to access the requested resource. When set to false, an HTTP 401 response is returned and the user can provide credentials with the appropriate permissions to gain access. Defaults to true.
如果为 true，则如果匿名用户没有所请求操作的适当权限，则会返回 HTTP 403 响应。系统不会提示用户提供访问所请求资源的凭据。当设置为 false 时，将返回 HTTP 401 响应，并且用户可以提供具有适当权限的凭据来获取访问权限。默认为 true。

设置如下

xpack.security.authc.anonymous.username: anonymous_user
xpack.security.authc.anonymous.roles: superuser

验证结果，用密码和不用密码都可以正常访问，但是用错误密码无法访问

root@woncnesdbtest1:~# curl -XGET "https://woncnesdbtest1:9200/_cat/health?v" -k
root@woncnesdbtest1:~# curl -XGET -uelastic:rightpassword "https://woncnesdbtest1:9200/_cat/health?v" -k
root@woncnesdbtest1:~# curl -XGET -uelastic:wrongpassword "https://woncnesdbtest1:9200/_cat/health?v" -k
{"error":{"root_cause":[{"type":"security_exception","reason":"unable to authenticate user [elastic] for REST request [/_cat/health?v]","header":{"WWW-Authenticate":["Basic realm=\"security\", charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}}],"type":"security_exception","reason":"unable to authenticate user [elastic] for REST request [/_cat/health?v]","header":{"WWW-Authenticate":["Basic realm=\"security\", charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}},"status":401}

如何设置http，即如何取消https，只需要把下面三个参数设置为false并重启即可

xpack.security.enabled: false
xpack.security.http.ssl:enabled: false
xpack.security.transport.ssl:enabled: false

xpack.security.enabled
(Static) Defaults to true, which enables Elasticsearch security features on the node. This setting must be enabled to use Elasticsearch’s authentication, authorization and audit features.
默认为 true，这会在节点上启用 Elasticsearch 安全功能。必须启用此设置才能使用 Elasticsearch 的身份验证、授权和审核功能。

xpack.security.http.ssl.enabled
(Static) Used to enable or disable TLS/SSL on the HTTP networking layer, which Elasticsearch uses to communicate with other clients. The default is false.
用于启用或禁用 HTTP 网络层上的 TLS/SSL，Elasticsearch 使用该网络层与其他客户端进行通信。默认为 false。

xpack.security.transport.ssl.enabled
(Static) Used to enable or disable TLS/SSL on the transport networking layer, which nodes use to communicate with each other. The default is false.
用于启用或禁用传输网络层上的 TLS/SSL，节点使用该层相互通信。默认为 false。

如果只是xpack.security.transport.ssl.enabled把设置为false，但是xpack.security.enabled还是true会有如下报错
bootstrap check failure [1] of [1]: Transport SSL must be enabled if security is enabled. Please set [xpack.security.transport.ssl.enabled] to [true] or disable security by setting [xpack.security.enabled] to [false]; for more information see [https://www.elastic.co/guide/en/elasticsearch/reference/8.17/bootstrap-checks-xpack.html#bootstrap-checks-tls]

设置为不启用SSL并且非匿名访问，发现最后还是可以匿名访问并且非匿名访问时用错误的密码可以正常连接

xpack.security.enabled: false
xpack.security.http.ssl:enabled: false
xpack.security.transport.ssl:enabled: false
#xpack.security.authc.anonymous.username: anonymous_user
#xpack.security.authc.anonymous.roles: superuser

验证

root@woncnesdbtest1:~# curl -XGET "https://woncnesdbtest1:9200/_cat/health?v" -k
curl: (35) error:0A00010B:SSL routines::wrong version number
root@woncnesdbtest1:~# 
root@woncnesdbtest1:~# curl -XGET -uelastic:rightpassword "https://woncnesdbtest1:9200/_cat/health?v" -k
curl: (35) error:0A00010B:SSL routines::wrong version number
root@woncnesdbtest1:~# 
root@woncnesdbtest1:~# curl -XGET "http://woncnesdbtest1:9200/_cat/health?v" -k
epoch      timestamp cluster          status node.total node.data shards pri relo init unassign unassign.pri pending_tasks max_task_wait_time active_shards_percent
1735899387 10:16:27  dailaesdbcluster green           4         4     14   6    0    0        0            0             0                  -                100.0%
root@woncnesdbtest1:~# 
root@woncnesdbtest1:~# curl -XGET -uelastic:rightpassword "http://woncnesdbtest1:9200/_cat/health?v" -k
epoch      timestamp cluster          status node.total node.data shards pri relo init unassign unassign.pri pending_tasks max_task_wait_time active_shards_percent
1735899393 10:16:33  dailaesdbcluster green           4         4     14   6    0    0        0            0             0                  -                100.0%
root@woncnesdbtest1:~# 
root@woncnesdbtest1:~# curl -XGET -uelastic:wrongpassword "http://woncnesdbtest1:9200/_cat/health?v" -k
epoch      timestamp cluster          status node.total node.data shards pri relo init unassign unassign.pri pending_tasks max_task_wait_time active_shards_percent
1735899409 10:16:49  dailaesdbcluster green           4         4     14   6    0    0        0            0             0                  -                100.0%

设置为不启用SSL并且匿名访问，发现最后还是可以匿名访问并且非匿名访问时用错误的密码可以正常连接

xpack.security.enabled: false
xpack.security.http.ssl:enabled: false
xpack.security.transport.ssl:enabled: false
xpack.security.authc.anonymous.username: anonymous_user
xpack.security.authc.anonymous.roles: superuser

验证

root@woncnesdbtest1:~# curl -XGET "https://woncnesdbtest1:9200/_cat/health?v" -k
curl: (35) error:0A00010B:SSL routines::wrong version number
root@woncnesdbtest1:~#
root@woncnesdbtest1:~# curl -XGET -uelastic:rightpassword "https://woncnesdbtest1:9200/_cat/health?v" -k
curl: (35) error:0A00010B:SSL routines::wrong version number
root@woncnesdbtest1:~#
root@woncnesdbtest1:~# curl -XGET "http://woncnesdbtest1:9200/_cat/health?v" -k
epoch      timestamp cluster          status node.total node.data shards pri relo init unassign unassign.pri pending_tasks max_task_wait_time active_shards_percent
1735900832 10:40:32  dailaesdbcluster green           4         4     14   6    0    0        0            0             0                  -                100.0%
root@woncnesdbtest1:~#
root@woncnesdbtest1:~# curl -XGET -uelastic:rightpassword "http://woncnesdbtest1:9200/_cat/health?v" -k
epoch      timestamp cluster          status node.total node.data shards pri relo init unassign unassign.pri pending_tasks max_task_wait_time active_shards_percent
1735900849 10:40:49  dailaesdbcluster green           4         4     14   6    0    0        0            0             0                  -                100.0%
root@woncnesdbtest1:~#
root@woncnesdbtest1:~# curl -XGET -uelastic:wrongpassword "http://woncnesdbtest1:9200/_cat/health?v" -k
epoch      timestamp cluster          status node.total node.data shards pri relo init unassign unassign.pri pending_tasks max_task_wait_time active_shards_percent
1735900861 10:41:01  dailaesdbcluster green           4         4     14   6    0    0        0            0             0                  -                100.0%
root@woncnesdbtest1:~#