Switching the Elasticsearch Security Mode

Scenario

Elasticsearch provides an independent switch for controlling the security mode. When security authentication is required, users can switch the security mode by modifying the configuration item.

• Switching from the security mode to the normal mode may cause security risks. Exercise caution when performing this operation.
• Normal-to-security switchover is risky, while security-to-normal switchover increases security risks but is not risky. Exercise caution when performing this operation.

Security-to-Normal Switchover

1. Log in to Manager.
2. Choose Cluster > Name of the desired cluster > Services > Elasticsearch > Configurations > All Configurations.

3. Search for the ELASTICSEARCH_SECURITY_ENABLE parameter, change its value to false, and click Save.

4. After the configuration is saved, restart the Elasticsearch service.
5. Choose Cluster > Name of the desired cluster > Services > Elasticsearch > More. Check whether the Enable Ranger button is unavailable.
   • If yes, no further action is required.
   • If no, the Elasticsearch service of the cluster uses the user- and role-based authentication mode. In this case, go to 6.

6. After switching the Elasticsearch mode, restart the authentication plug-in.
   1. Log in to the active OMS node as user root, and run the following command to switch to user omm:

      su - omm

   2. Run the following command to search for the process of the authentication plug-in:

      jps | grep AosMainProcess

   3. Run the following command to stop the process of the authentication plug-in:

      kill -9 pid

      Set pid to the process ID obtained in 6.b.

   4. Wait about three minutes until the authentication plug-in process is automatically restarted.

Normal-to-Security Switchover

1. Choose Cluster > Name of the desired cluster > Services > Elasticsearch > More. Check whether the Enable Ranger button is unavailable.
   • If yes, the Elasticsearch service of the cluster uses the Ranger-based authentication mode. In this case, go to 2.
   • If no, the Elasticsearch service of the cluster uses the user- and role-based authentication mode. In this case, go to 3.

2. Create a policy in Ranger by referring to Authentication Based on Ranger based on the index name and permission control information used by the user. Otherwise, the existing policies cannot be accessed after you have switched the authentication mode, and no other action is required.
3. For details about preparations before switching from the normal mode to the security mode and configuration operations after the switchover, see Synchronizing Index Owner Group.

4. After switching the Elasticsearch mode, restart the authentication plug-in.
   1. Log in to the active OMS node as user root, and run the following command to switch to user omm:

      su - omm

   2. Run the following command to search for the process of the authentication plug-in:

      jps | grep AosMainProcess

   3. Run the following command to stop the process of the authentication plug-in:

      kill -9 pid

      Set pid to the process ID obtained in 4.b.

   4. Wait about three minutes until the authentication plug-in process is automatically restarted.