OPEN MIND - OPEN SOURCE

1- Arrêter les services Elasticsearch et Kibana :

# systemctl stop elasticsearch
# systemctl stop kibana


2- Vérifier que les services Elasticsearch et Kibana sont bien arrêtés :


# systemctl status elasticsearch
● elasticsearch.service - Elasticsearch
   Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; enabled; vendor preset: disabled)
   Active: inactive (dead) since Fri 2021-04-02 23:39:41 CEST; 3min 59s ago
     Docs: https://www.elastic.co
  Process: 1133 ExecStart=/usr/share/elasticsearch/bin/systemd-entrypoint -p ${PID_DIR}/elasticsearch.pid --quiet (code=exited, status=143)
Main PID: 1133 (code=exited, status=143)

Apr 01 22:09:56 elk.stack systemd[1]: Starting Elasticsearch...
Apr 01 22:10:34 elk.stack systemd[1]: Started Elasticsearch.
Apr 02 23:39:41 elk.stack systemd[1]: Stopping Elasticsearch...
Apr 02 23:39:41 elk.stack systemd[1]: Stopped Elasticsearch.


# systemctl status kibana
● kibana.service - Kibana
   Loaded: loaded (/etc/systemd/system/kibana.service; enabled; vendor preset: disabled)
   Active: inactive (dead) since Fri 2021-04-02 23:39:58 CEST; 19s ago
     Docs: https://www.elastic.co
  Process: 1129 ExecStart=/usr/share/kibana/bin/kibana --logging.dest="/var/log/kibana/kibana.log" --pid.file="/run/kibana/kibana.pid" (code=exited, status=0/SUCCESS)
Main PID: 1129 (code=exited, status=0/SUCCESS)

Apr 01 22:09:55 elk.stack systemd[1]: Started Kibana.
Apr 02 23:39:58 elk.stack systemd[1]: Stopping Kibana...
Apr 02 23:39:58 elk.stack systemd[1]: Stopped Kibana.


3- Editer le fichier de configuration elasticsearch.yml et ajouter les paramètres suivant "xpack.security.enabled: true" "xpack.security.transport.ssl.enabled: true" à la fin du fichier :

# vi /etc/elasticsearch/elasticsearch.yml

# ---------------------------------- Various -----------------------------------
#
# Require explicit names when deleting indices:
#
#action.destructive_requires_name: true
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true

4- Création des mots de passe pour les utilisateurs elk :

- Démarrer le service elasticsearch

# systemctl start elasticsearch

- Generer les mots de passe aléatoirement

# cd /usr/share/elasticsearch/
# ./bin/elasticsearch-setup-passwords auto

- Pour générer les mots de passe manuellement

# ./bin/elasticsearch-setup-passwords interactive

5- Configurer Kibana pour s'authentifier à ElasticSearch :

- Editer le fichier kibana.yml et éditer  le paramètre : elasticsearch.username: "elastic"

# vi /etc/kibana/kibana.yml

# If your Elasticsearch is protected with basic authentication, these settings provide
# the username and password that the Kibana server uses to perform maintenance on the Kibana
# index at startup. Your Kibana users still need to authenticate with Elasticsearch, which
# is proxied through the Kibana server.
elasticsearch.username: "elastic"
#elasticsearch.password: "pass"

- Création d'une "Keystore" Kibana

# cd /usr/share/kibana/
# ./bin/kibana-keystore create

- Ajouter le mot de passe de l'utilisateur "elastic" dans la keystore kibana

# ./bin/kibana-keystore add elasticsearch.password
Enter value for elasticsearch.password: ********************

- Démarrer le service kibana

# systemctl start kibana

=> Connecter maintenant à l'interface web de Kibana avec l'utilisateur "elastic" et son mot de passe.