在使用ELK进行日志统计的时候,由于Kibana自身并没有身份验证的功能,任何人只要知道链接地址就可以正常登录到Kibana控制界面,由于日常的查询,添加和删除日志都是在同一个web中进行,这样就有极高的安全隐患.任何人都有权限对其进行修改,为了避免这一问题,可以使用Nginx的验证功能来代理Kibana.
1.先用haproxy代理
# haproxy的安装和配置可参考之前的博文 # 实验环境,IP:10.0.0.33,没有安装过kibana、es、haproxy,kibana的安装不需要java环境 yum -y install kibana-5.4.0-x86_64.rpm /usr/local/haproxy/sbin/haproxy -v HA-Proxy version 1.7.11 2018/04/30 Copyright 2000-2018 Willy Tarreau <[email protected]> grep "^[a-Z]" /etc/kibana/kibana.yml server.port: 5601 server.host: "127.0.0.1" elasticsearch.url: "http://10.0.0.22:9200" systemctl start kibana cat /etc/haproxy/haproxy.cfg global maxconn 100000 chroot /usr/local/haproxy uid 1000 gid 1000 daemon nbproc 1 pidfile /usr/local/haproxy/run/haproxy.pid log 127.0.0.1 local6 info defaults option http-keep-alive option forwardfor maxconn 100000 mode http timeout connect 300000ms timeout client 300000ms timeout server 300000ms listen stats mode http bind 0.0.0.0:9999 stats enable log global stats uri /haproxy-status stats auth haadmin:123456 #frontend web_port frontend web_port bind 0.0.0.0:80 mode http option httplog log global option forwardfor #ACL Setting acl kibana hdr_dom(host) -i www.kibanahaproxy.com #USE ACL use_backend kibana_host if kibana backend kibana_host mode http option httplog balance source server web1 127.0.0.1:5601 check inter 2000 rise 3 fall 2 weight 1 systemctl start haproxy.service
windows的hosts添加一条记录,然后访问http://www.kibanahaproxy.com
10.0.0.33 www.kibanahaproxy.com
2.关掉haproxy,用nginx代理kibana并实现登录验证
systemctl stop haproxy.service
# yum安装nginx
wget http://nginx.org/packages/centos/7/noarch/RPMS/nginx-release-centos-7-0.el7.ngx.noarch.rpm
rpm -ivh nginx-release-centos-7-0.el7.ngx.noarch.rpm
yum -y install nginx
rpm -qa | grep nginx
nginx-1.14.1-1.el7_4.ngx.x86_64
# 创建验证文件授权,需要先安装httpd-tools
yum -y install httpd-tools
# 第一次创建用户需要-c参数
htpasswd -bc /etc/nginx/htpasswd.users lixiang root123456
htpasswd -b /etc/nginx/htpasswd.users lisi root123
cat /etc/nginx/htpasswd.users
cat kibana.conf
upstream kibana_server {
server 127.0.0.1:5601 weight=1 max_fails=3 fail_timeout=60;
}
server {
listen 80;
server_name www.kibananginx.com;
auth_basic "Restricted Access";
auth_basic_user_file /etc/nginx/htpasswd.users;
location / {
proxy_pass http://kibana_server;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_cache_bypass $http_upgrade;
}
}
systemctl start nginx
如果是编译安装的nginx,需要修改配置文件和验证文件的属主、属组
chown -R www.www /usr/local/nginx/conf
nginx成功代理kibana
Kibana使用Nginx代理验证:http://blog.51cto.com/tryingstuff/2049877