Getting error after installed standlone elasticsearch security plugin

Security
1

I am new to opendistro standlone plugins. I tried to customize my ELK stack (from elastic.io) with opendistro security and alerting plugin in centos 7. I have successsfully installed the security elastic search plugin with the opendistro provided demo certificates (env is non prod).

Before adding opendistro security plugin, I was successfully running this ELK without any issues.

Versions :

Eleasticsearch - 7.4.2
Kibana - 7.4.2
Opendistro security plugin - 1.4.0.0
I have onl one VM, which contains Logstash, Elasticsearch and Kibana (with newly added openistro security and alerting plugin)

After installation, restarted elasticsearch (sudo systemctl start elasticsearch), I am getting an error like below:

org.elasticsearch.common.xcontent.json.JsonXContentParser.nextToken(JsonXContentParser.java:52)
elasticsearch[24567]: at org.elasticsearch.common.settings.Settings.fromXContent(Settings.java:645)
Feb 15 20:52:46 elasticsearch[24567]: at org.elasticsearch.common.settings.Settings.fromXContent(Settings.java:620)
Feb 15 20:52:46 elasticsearch[24567]: at org.elasticsearch.common.settings.Settings.access$400(Settings.java:82)
Feb 15 20:52:46 elasticsearch[24567]: at org.elasticsearch.common.settings.Settings$Builder.loadFromStream(Settings.java:1093)

[2020-02-15T20:37:46,352][INFO ][o.e.n.Node ] [master] stopping …
[2020-02-15T20:37:46,385][INFO ][o.e.x.w.WatcherService ] [master] stopping watch service, reason [shutdown initiated]
[2020-02-15T20:37:46,386][INFO ][o.e.x.w.WatcherLifeCycleService] [master] watcher has stopped and shutdown
[2020-02-15T20:37:46,711][INFO ][o.e.x.m.p.l.CppLogMessageHandler] [master] [controller/11581] [Main.cc@150] Ml controller exiting
[2020-02-15T20:37:46,712][INFO ][o.e.x.m.p.NativeController] [master] Native controller process has stopped - no new native processes can be started
[2020-02-15T20:37:52,246][INFO ][o.e.n.Node ] [master] stopped
[2020-02-15T20:37:52,246][INFO ][o.e.n.Node ] [master] closing …
[2020-02-15T20:37:52,338][INFO ][o.e.n.Node ] [master] closed

while installing, I was getting some warning like below (oracle java) :

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: plugin requires additional permissions @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

  • java.lang.RuntimePermission createClassLoader
  • java.lang.RuntimePermission getClassLoader
  • java.net.NetPermission getProxySelector
  • java.net.SocketPermission * connect,resolve
    See Permissions in the JDK
    for descriptions of what these permissions allow and the associated risks.

please help me to resolved this issue.

2

more stacktrace on this issue -

{“type”: “server”, “timestamp”: “2020-02-17T10:14:18,750Z”, “level”: “INFO”, “component”: “o.e.x.m.p.l.CppLogMessageHandler”, “cluster.name”: “idams-nonprod-elk”, “node.name”: “master”, “message”: “[controller/33614] [Main.cc@110] controller (64 bit): Version 7.4.2 (Build 473f61b8a5238b) Copyright (c) 2019 Elasticsearch BV” }
{“type”: “server”, “timestamp”: “2020-02-17T10:14:20,994Z”, “level”: “DEBUG”, “component”: “o.e.a.ActionModule”, “cluster.name”: “idams-nonprod-elk”, “node.name”: “master”, “message”: “Using REST wrapper from plugin org.elasticsearch.xpack.security.Security” }
{“type”: “server”, “timestamp”: “2020-02-17T10:14:20,995Z”, “level”: “DEBUG”, “component”: “o.e.a.ActionModule”, “cluster.name”: “idams-nonprod-elk”, “node.name”: “master”, “message”: “Using REST wrapper from plugin com.amazon.opendistroforelasticsearch.security.OpenDistroSecurityPlugin” }
{“type”: “server”, “timestamp”: “2020-02-17T10:14:21,004Z”, “level”: “ERROR”, “component”: “o.e.b.Bootstrap”, “cluster.name”: “idams-nonprod-elk”, “node.name”: “master”, “message”: “Exception”,
“stacktrace”: [“java.lang.IllegalArgumentException: Cannot have more than one plugin implementing a REST wrapper”,
“at org.elasticsearch.action.ActionModule.(ActionModule.java:396) ~[elasticsearch-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.node.Node.(Node.java:457) ~[elasticsearch-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.node.Node.(Node.java:255) ~[elasticsearch-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.bootstrap.Bootstrap$5.(Bootstrap.java:221) ~[elasticsearch-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:221) ~[elasticsearch-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:349) [elasticsearch-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:159) [elasticsearch-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:150) [elasticsearch-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) [elasticsearch-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:125) [elasticsearch-cli-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.cli.Command.main(Command.java:90) [elasticsearch-cli-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:115) [elasticsearch-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:92) [elasticsearch-7.4.2.jar:7.4.2]”] }
{“type”: “server”, “timestamp”: “2020-02-17T10:14:21,028Z”, “level”: “WARN”, “component”: “o.e.b.ElasticsearchUncaughtExceptionHandler”, “cluster.name”: “idams-nonprod-elk”, “node.name”: “master”, “message”: “uncaught exception in thread [main]”,
“stacktrace”: [“org.elasticsearch.bootstrap.StartupException: java.lang.IllegalArgumentException: Cannot have more than one plugin implementing a REST wrapper”,
“at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:163) ~[elasticsearch-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:150) ~[elasticsearch-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) ~[elasticsearch-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:125) ~[elasticsearch-cli-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.cli.Command.main(Command.java:90) ~[elasticsearch-cli-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:115) ~[elasticsearch-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:92) ~[elasticsearch-7.4.2.jar:7.4.2]”,
“Caused by: java.lang.IllegalArgumentException: Cannot have more than one plugin implementing a REST wrapper”,
“at org.elasticsearch.action.ActionModule.(ActionModule.java:396) ~[elasticsearch-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.node.Node.(Node.java:457) ~[elasticsearch-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.node.Node.(Node.java:255) ~[elasticsearch-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.bootstrap.Bootstrap$5.(Bootstrap.java:221) ~[elasticsearch-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:221) ~[elasticsearch-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:349) ~[elasticsearch-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:159) ~[elasticsearch-7.4.2.jar:7.4.2]”,
“… 6 more”] }

I also tried to disable the xpack in elasticsearch.yml file (xpack.security.enabled: false), still failing…

please help me to resolve this issue.

3

Hello !
Whenever I had xpack’s related errors,I fixed them with installing Elasticsearch-OSS version. Open Source Software, not the Elasticsearch basic version.
Maybe It can fix your error.

Cannot have more than one plugin implementing a REST wrapper
You should investigate this error.

Hope it helps.
Thi

4

I solved this by completely removing xpack security from modules directory.

As for prrmissions - which version of Java you are using? I think I’ve seen some simillar problems with Java 13, so still sit with 11.

Currently running 7.1.1 with X-Pack basic for ILM + OpenDistro Security 1.1.0.3.

5

Thank you for your reply.

6

Thank you @DmitryOlshansky

I am using openJDK 1.8 version in centos 7.

could you pls share the steps that yo followed to implement the opendistro security / alerting plugins with ELK 7.x (from elastic.io). you did remove the x-pack plugins from the elastic search plugins folder or anything more?

appreciate your help and support.

Regards.

7

Sorry for dropping off so rapidly, I’m not used to these online discuss thingies.

As for steps, that’s what I did in our playbooks on Ubuntu:
rm -rf /usr/share/elasticsearch/modules/x-pack-security

Also I dropped ML plugin as we’ll never use it so why keep trash around:
rm -rf /usr/share/elasticsearch/modules/x-pack-ml

It’s enough to avoid this conflict

8

Is there way to get it working without deleting x-pack module

9

@parag1 Did you try disabling the x-pack security module? the 2 can’t be run side by side. Hope this helps