Elasticsearch single-node cluster

Adding the Elastic Stack repository

Elasticsearch installation and configuration

1. Install the Elasticsearch package:

   Yum

   APT

   # yum install elasticsearch-7.17.9
   

   # apt-get install elasticsearch=7.17.9
   

2. Once Elasticsearch is installed, it can be configured by downloading the file /etc/elasticsearch/elasticsearch.yml:

   # curl -so /etc/elasticsearch/elasticsearch.yml https://packages.wazuh.com/4.4/tpl/elastic-basic/elasticsearch.yml
   

Certificates creation and deployment

1. The number of Wazuh servers to be implemented will determine the next step. Select Wazuh single-node cluster, if there is only one Wazuh server, or Wazuh multi-node cluster in case there are two or more Wazuh servers.

   Wazuh single-node cluster

   Wazuh multi-node cluster

   The instances file can be created /usr/share/elasticsearch/instances.yml as follows:

   cat > /usr/share/elasticsearch/instances.yml <<\EOF
   instances:
   - name: "elasticsearch"
     ip:
     - "10.0.0.2"
   - name: "filebeat"
     ip:
     - "10.0.0.3"
   - name: "kibana"
     ip:
     - "10.0.0.4"
   EOF
   

   Every name section corresponds to one host in the Wazuh Server - Elastic Stack environment. In this example, the file describes:

   • An elasticsearch instance with IP address 10.0.0.2.

   • A filebeat instance with IP address 10.0.0.3 corresponding to a single-node Wazuh cluster.

   • A kibana instance with IP address 10.0.0.4. If Kibana will be installed in the same server as Elasticsearch, the same IP address may be used.

   Replace the IPs with the corresponding addresses for each instance in your environment.

   Create the certificates using the elasticsearch-certutil tool:

   # /usr/share/elasticsearch/bin/elasticsearch-certutil cert ca --pem --in instances.yml --keep-ca-key --out ~/certs.zip
   

   The resulting file certs.zip contains a directory for each instance included in instances.yml. Each directory contains a certificate and a private key necessary to secure communications.

   The instances file /usr/share/elasticsearch/instances.yml must be created as follows:

   cat > /usr/share/elasticsearch/instances.yml <<\EOF
   instances:
   - name: "elasticsearch"
     ip:
     - "10.0.0.2"
   - name: "filebeat-1"
     ip:
     - "10.0.0.3"
   - name: "filebeat-2"
     ip:
     - "10.0.0.4"
   - name: "kibana"
     ip:
     - "10.0.0.5"
   EOF
   

   Every name section corresponds to one host in the Wazuh Server - Elastic Stack environment. In this example, the file describes:

   • An elasticsearch instance with IP 10.0.0.2. It is an Elasticsearch single-node cluster.

   • Two filebeat instances, the #1 and #2 with their respective IPs 10.0.0.3 and 10.0.0.4. These correspond to two Wazuh cluster nodes. In the case of configuring a Wazuh multi-node cluster with three or more nodes, more name sections with their respective names and IPs can be defined.

   • A kibana instance with IP address 10.0.0.5. If Kibana will be installed on the same server as Elasticsearch, the same Elasticsearch instance IP address should be used.

   Replace the IPs of this example with the corresponding addresses in your environment.

   Create the certificates using the elasticsearch-certutil tool:

   # /usr/share/elasticsearch/bin/elasticsearch-certutil cert ca --pem --in instances.yml --keep-ca-key --out ~/certs.zip
   

   The resulting file certs.zip contains a directory for each instance included in instances.yml. Each directory contains a certificate and a private key necessary to secure communications.

2. Copy ~/certs.zip to all the servers of the distributed deployment. This can be done by using, for example, scp.

3. The next step is to create the directory /etc/elasticsearch/certs, and then copy the certificate authorities, the certificate and key there:

   # unzip ~/certs.zip -d ~/certs
   # mkdir /etc/elasticsearch/certs/ca -p
   # cp -R ~/certs/ca/ ~/certs/elasticsearch/* /etc/elasticsearch/certs/
   # chown -R elasticsearch: /etc/elasticsearch/certs
   # chmod -R 500 /etc/elasticsearch/certs
   # chmod 400 /etc/elasticsearch/certs/ca/ca.* /etc/elasticsearch/certs/elasticsearch.*
   # rm -rf ~/certs/
   

4. If you are going to install Kibana in this node, keep the certificates file. Otherwise, if the file has been copied already to all the instances of the distributed deployment, remove it to increase security rm -f ~/certs.zip.

5. Enable and start the Elasticsearch service:

   Systemd

   SysV init

   # systemctl daemon-reload
   # systemctl enable elasticsearch
   # systemctl start elasticsearch
   

   Choose one option according to the OS used:

   1. Debian based OS

   # update-rc.d elasticsearch defaults 95 10
   # service elasticsearch start
   

   2. RPM based OS

   # chkconfig --add elasticsearch
   # service elasticsearch start
   

6. Generate credentials for all the Elastic Stack pre-built roles and users:

   # /usr/share/elasticsearch/bin/elasticsearch-setup-passwords auto
   

   The command above will prompt an output like this. Save the password of the elastic user for further steps:

   Changed password for user apm_system
   PASSWORD apm_system = lLPZhZkB6oUOzzCrkLSF
   
   Changed password for user kibana_system
   PASSWORD kibana_system = TaLqVOnSoqKTYLIU0vDn
   
   Changed password for user kibana
   PASSWORD kibana = TaLqVOvXoqKTYLIU0vDn
   
   Changed password for user logstash_system
   PASSWORD logstash_system = UtuDv2tWkXGYL83v9kWA
   
   Changed password for user beats_system
   PASSWORD beats_system = qZcbvCslafMpoEOrE9Ob
   
   Changed password for user remote_monitoring_user
   PASSWORD remote_monitoring_user = LzJpQiSylncmCU2GLBTS
   
   Changed password for user elastic
   PASSWORD elastic = AN4UeQGA7HGl5iHpMla7