Installation, configuration and security Flashcards by Giorgenes G

How to set up number of open file limits for elastic?

Edit /etc/security/limits.conf
Add “elastic - nofile 65536

It will complain when running if not setup correctly

How well did you know this?

Not at all

Perfectly

How to setup vm max size for elastic?

edit /etc/sysctl.conf
Add “vm.max_map_count = 262144”

This comes from the documentation and should be verified by elastic on startup

How well did you know this?

Not at all

Perfectly

Where to install the archive package?

elastic user home (/home/elastic)

How well did you know this?

Not at all

Perfectly

How to fetch/install elastic?

Download from the artifacts with curl.
Unpack inside the home directory
Clean it up
Rename the directory to just “elasticsearch”

How well did you know this?

Not at all

Perfectly

Which version of elastic comes with JDK prepackaged?

From version 7.

How well did you know this?

Not at all

Perfectly

What are the essential configuration options for each node?

For every node

cluster.name
node.name
network.host: [local, site]
cluster.initial_master_nodes: [….]. # the name of the initial master nodes (for security and also prevent split brain)

# node roles
master, data, ingest (set true by default)
- node.master = true
- node.data = true
- node.ingest = false

# For non-masters
- discovery.seed_hosts:

Custom attributes:
- node.attr.zone

How well did you know this?

Not at all

Perfectly

What’s the difference between local, site and global?

Matches configured network addresses.

local -> loopback: 127.0.0.1
site -> local network eg: 192.168…
global: external network like 200.x.y… etc

How well did you know this?

Not at all

Perfectly

How do you make a coordinator only node?

Set all data roles to false (node.master: false, node.data: false, node.ingest: false)

How well did you know this?

Not at all

Perfectly

How to setup java VM heap size for the nodes?

Edit “config/jvm.options”

- Edit “-Xms” and “-Xmx” options

How well did you know this?

Not at all

Perfectly

How to start elastic node in the foreground?

./bin/elasticsearch

How well did you know this?

Not at all

Perfectly

What are the default elastic search ports?

9200 (HTTP Rest API)
9300 (Transport) binary inter node protocol

How well did you know this?

Not at all

Perfectly

Where to put the the certificate files?

You can put it inside “config/certs”

How well did you know this?

Not at all

Perfectly

How do you create a certificate authority?

bin/elasticsearch-certutil ca –out config/certs/ca –pass
relative paths will be relative to “elasticsearch” directory
best practice is to create a password for the CA

How well did you know this?

Not at all

Perfectly

How many certificates do I need?

Create one certificate for each node.

How well did you know this?

Not at all

Perfectly

How to create the node certificates?

bin/elasticsearch-certutil cert –ca config/certs/ca –ca-pass –name –out config/certs/ –pass

How well did you know this?

Not at all

Perfectly

What is DNS verification for the certificates?

You can specify a domain to be verified with the DNS on top of the certificate, allowing the certificate to be used only on the IP/domain it was designed for.
This can be added as an extra option for certutil.

What’s the process for securing a cluster?

Create a certificate authority (CA)
Create a certificate for each node
Copy each node’s certificate to its server (scp)
Make sure permissions are right after you copy (elastic)
Add the cert passwords to the keystore/truststore on each node
Add security settings to config file
Restart process
Bootstrap passwords
Update kibana config with the new password.

What’s the difference between securing the cluster network and the client network?

In a production environment, you’d want the client network (which could be public facing) to have a global CA certificate that you need to purchase.
The cluster network can be self signed (with a CA that you generate).

For internal use only, you can use the same self signed CA.

How to add the certificates to the keystore and trust store?

Cluster network (transport)

bin/elasticsearch-keystore add xpack.security.transport.ssl.keystore.secure_password
- >
bin/elasticsearch-keystore add xpack.security.transport.ssl.truststore.secure_password
- >

Client network (http)

bin/elasticsearch-keystore add xpack.security.http.ssl.keystore.secure_password
- >
bin/elasticsearch-keystore add xpack.security.http.ssl.truststore.secure_password
- >

What certificate type is created by certtool by default and what is its characteristic?

PKCS 12
It’s a certificate bundle
Includes a private key and certificate.
Extensions usually .p12 or .pfx

How to see the current keys set in the keystore?

bin/elasticsearch-keystore list

What are the configuration options for enabling security?

in config/elasticsearch.yml (for each node)

xpack.security.enabled: true

cluster

xpack. security.transport.ssl.enabled: true # cluster network
xpack. security.transport.ssl.verification_mode: certificate # this is where you would enable full verification for DNS checks if it was global certificate
xpack. security.transport.ssl.keystore.path: certs/ # relative path
xpack. security.transport.ssl.truststore.path: certs/ # relative path

client

xpack. security.http.ssl.enabled: true # cluster network
xpack. security.http.ssl.verification_mode: certificate # this is where you would enable full verification for DNS checks if it was global certificate
xpack. security.http.ssl.keystore.path: certs/ # relative path
xpack. security.http.ssl.truststore.path: certs/ # relative path

What’s the difference between keystore and truststore?

Keystore is used to store private key and identity certificates that a specific program should present to both parties (server or client) for verification.

Truststore is used to store certificates from Certified Authorities (CA) that verify the certificate presented by the server in SSL connection.

https://www.educative.io/answers/keystore-vs-truststore

How are elastic’s built-in users bootstraped?

Built-in user passwords are bootstrapped when you enable security

How to bootstrap user passwords?

After you enable security: - bin/elasticsearch-setup-passwords interactive - This will cycle through all the default users and ask for a password. - just needs to be done on a single node, this is propagated to the entire cluster.

How to setup kibana access to elastic with security on?

config/kibana.yml - elasticsearch.username: kibana - elasticsearch.password: With client ssl on: - elasticsearch.hosts: ["https://localhost:9200"] # must be https - elasticsearch.ssl.verificationMode: none # for self signed certificates

What happens if you enable client ssl with a self signed certificate?

Clients like curl will complain about the certificate because it doesn't have the CA config. You can ignore with -k on curl, for example.

What is the "run as" option for a user rule?

Allow users with a specific role to send commands as another user. Question: What's the use case for this?

How to specify index access for user roles?

Either specify the index name, an alias or a wildcard pattern "with *".

What role do you need to access kibana?

kibana_user (or superuser)

What happens with security exceptions?

Security exceptions are logged to security indexes which can be monitored.

What api to check the existing user roles and create new ones?

GET _security/roles GET _security/roles/ POST _security/roles/ TODO: add sample here

Where do I create and manage users?

Either use the API or from kibana admin console as a useradmin.

How do you enable DNS certificate check?

in config/elasticsearch.yml (for each node) xpack.security.transport.ssl.verification_mode: certificate this is where you would enable full verification for DNS checks if it was global certificate

What are elastic's built-in users?

- elastic - kibana_system - logstash_system - beats_system - apm_system - remote_monitoring_user