Using opensearch 1.3.2 in a docker environment on redhat and trying to configure ldaps.
But with a twist: i’d like to test this out without having certificates for my nodes/dashboards. As our environment only has secure ldap servers, i’m wondering if this is possible as it’s a hassle getting the required certificates.
some more info:
my config.yml
---
_meta:
type: "config"
config_version: 2
config:
dynamic:
http:
anonymous_auth_enabled: false
authc:
internal_auth:
order: 0
description: "HTTP basic authentication using the internal user database"
http_enabled: false
transport_enabled: false
http_authenticator:
type: basic
challenge: true
authentication_backend:
type: internal
ldap_auth:
order: 1
description: "Authenticate using LDAP"
http_enabled: true
transport_enabled: true
http_authenticator:
type: basic
challenge: true
authentication_backend:
type: ldap
config:
enable_ssl: true
enable_start_tls: false
enable_ssl_client_auth: false
verify_hostnames: false
hosts:
- xxxxxxxx:636
bind_dn: 'CN=xxxx,OU=xxxx,OU=xxxx,DC=xxx,DC=xxxxx'
password: 'xxxxx'
userbase: 'OU=x,OU=x,OU=x,OU=x,DC=x,DC=x'
usersearch: '(mail={0})'
username_attribute: null
my opensearch_dashboards.yml (<== is this correct or does this need to be opensearch.yml?)
server.port: 5601
server.host: "0.0.0.0"
opensearch.hosts: ["http://localhost:9200"]
opensearch.username: kibanaserver
opensearch.password: kibanaserver
server.ssl.enabled: false
opensearch.ssl.verificationMode: none
opensearch_security.multitenancy.enabled: false
opensearch_security.multitenancy.tenants.enable_global: true
opensearch_security.multitenancy.tenants.enable_private: true
opensearch_security.multitenancy.tenants.preferred: ["Private", "Global"]
opensearch_security.multitenancy.enable_filter: false
opensearch_security.readonly_mode.roles: ["kibana_read_only"]
# Use this setting if you are running kibana without https
opensearch_security.cookie.secure: false
my docker-compose.yml:
version: '3.5'
services:
opensearch-node1:
image: opensearchproject/opensearch:1.3.2
container_name: opensearch-node1
environment:
- cluster.name=opensearch-cluster
- node.name=opensearch-node1
- discovery.type=single-node
- bootstrap.memory_lock=false # along with the memlock settings below, disables swapping
- "OPENSEARCH_JAVA_OPTS=-Xms512m -Xmx512m"
ulimits:
memlock:
soft: -1
hard: -1
nofile:
soft: 65536 # maximum number of open files for the OpenSearch user, set to at least 65536 on modern systems
hard: 65536
configs:
- source: ldap_auth_elk
target: /usr/share/opensearch/plugins/opensearch-security/securityconfig/config.yml
- source: opensearch_roles
target: /usr/share/opensearch/plugins/opensearch-security/securityconfig/roles_mapping.yml
volumes:
- esdata:/usr/share/opensearch/data
ports:
- 9200:9200
- 9600:9600 # required for Performance Analyzer
networks:
- opensearch-net
opensearch-dashboards:
image: opensearchproject/opensearch-dashboards:1.3.2
container_name: opensearch-dashboards
environment:
- OPENSEARCH_HOSTS=["https://opensearch-node1:9200"]
ports:
- 5601:5601
configs:
- source: opensearch_kibana
target: /usr/share/opensearch-dashboards/config/opensearch_dashboards.yml
networks:
- opensearch-net
logstash:
image: opensearchproject/logstash-oss-with-opensearch-output-plugin:7.16.3
container_name: logstash
configs:
- source: opensearch_logstash
target: /config-dir/logstash_http_json.conf
command: logstash -f /config-dir/logstash_http_json.conf
volumes:
- logstash:/config-dir
environment:
- OPENSEARCH_HOSTS='["https://opensearch-node1:9200"]'
ports:
- 5043:5043
networks:
- opensearch-net
volumes:
esdata:
logstash:
configs:
ldap_auth_elk:
external: true
opensearch_kibana:
external: true
opensearch_roles:
external: true
opensearch_logstash:
external: true
networks:
opensearch-net:
we’re getting somewhere