ELK的安全解决方案 X-Pack（1）

安装 X-Pack 前必须安装 elasticsearch、 Kibana、logstash,因为之前安装ELK选择的版本都是5.4.1，所以这次选择X-Pack的版本也要是5.4.1的

第一步：下载安装包

wget https://artifacts.elastic.co/downloads/packs/x-pack/x-pack-5.4.1.zip

第二步，：将下载的zip文件转移到/tmp文件目录下

mv  x-pack-5.2..zip /tmp

第三步：在ES的安装目录下运行elasticsearch-plugin命令安装

./elasticsearch-plugin install file:/tmp/x-pack-5.4..zip

显示下面的内容表示安装成功：

[root@elk-server bin]# ./elasticsearch-plugin install file:/tmp/x-pack-5.4..zip
-> Downloading file:/tmp/x-pack-5.4..zip
[=================================================] %  
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@     WARNING: plugin requires additional permissions     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
* java.io.FilePermission \\.\pipe\* read,write
* java.lang.RuntimePermission accessClassInPackage.com.sun.activation.registries
* java.lang.RuntimePermission getClassLoader
* java.lang.RuntimePermission setContextClassLoader
* java.lang.RuntimePermission setFactory
* java.security.SecurityPermission createPolicy.JavaPolicy
* java.security.SecurityPermission getPolicy
* java.security.SecurityPermission putProviderProperty.BC
* java.security.SecurityPermission setPolicy
* java.util.PropertyPermission * read,write
* java.util.PropertyPermission sun.nio.ch.bugLevel write
* javax.net.ssl.SSLPermission setHostnameVerifier
See http://docs.oracle.com/javase/8/docs/technotes/guides/security/permissions.html
for descriptions of what these permissions allow and the associated risks.

Continue with installation? [y/N]y
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@        WARNING: plugin forks a native controller        @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
This plugin launches a native controller that is not subject to the Java
security manager nor to system call filters.

Continue with installation? [y/N]y
-> Installed x-pack

第四步：在kibana安装目录下运行kibana-plugin命令安装

./kibana-plugin install file:/tmp/x-pack-5.4..zip

显示下面的内容表示安装成功：

[root@elk-server bin]# ./kibana-plugin install file:/tmp/x-pack-5.4..zip
Attempting to transfer from file:/tmp/x-pack-5.4..zip
Transferring  bytes....................
Transfer complete
Retrieving metadata from plugin archive
Extracting plugin archive
Extraction complete
Optimizing and caching browser bundles...
Killed

第五步：在logstash的安装目录下logstash-plugin命令安装

./logstash-plugin install file:/tmp/x-pack-5.4..zip

显示下面的内容表示安装成功：

[root@elk-server bin]# ./logstash-plugin install file:/tmp/x-pack-5.4..zip
OpenJDK -Bit Server VM warning: If the number of processors is expected to increase from one, then you should configure the number of parallel GC threads appropriately using -XX:ParallelGCThreads=N
Installing file: /tmp/x-pack-5.4..zip
Install successful