Evebox and ELK with HTTPS enabled (Self-Signed Certificates) #144
Comments
|
There is no way right now. Do you have a PEM or PKCS12 client certificate you have to present? Is it password protected? |
|
Hi,
I have PKCS12 certificate without password.
Thank you
|
|
Ok, this is something I'll need to add.. Its somewhere on the todo list anyways. Will try to add in the next few days, and I hope you can try out a development build. |
|
Thank you!
|
|
I have a development build here: https://evebox.org/files/development/evebox-latest-linux-x64.zip On first look I thought you might have been trying to use client certificate based authentication, but realized that EveBox simply had an issue connecting to any server with a self-signed certificate, basically You can just unzip the build and run |
|
I'll try that today. Thank you! |
|
I haven't had the opportunity to try this out, as I was struggling with TLS and Logstash all day, but this has been resolved, so I promise that tomorrow morning I will dedicate time to Evebox. Thank you |
|
Hi @jasonish , Finally I was able to fix Logstash and beats to access Elasticsearch with TLS enabled. Now I am testing Evebox. This is what I did:
Remember that I am running SELKS 6, which was using the sqlite config file. evebox default configevebox.ymlPrevious EveboxDev Evebox |
|
I don't have a work-around for you yet. But I see that I'm not logging enough data in that error to debug this, so I have a new build with better logging available at: I have tested this with my own install of Elasticsearch with authentication enabled and using a self-signed certificate. I also tested with Elastic's hosted cloud support, and it works. Have you setup Elasticsearch to require client certification authentication? |
|
Hi, As always, I appreciate your prompt response. I have configured ELK to use a security certificate (self signed for now). So Elasticsearch is accepting only https connections that will also require a certificate. I will be testing the new dev version shortly and will provide the feedback. Thank you |
|
Ok, I don't have support yet for EveBox preventing a client certificate to Elasticsearch. It appears the hosted Elasticsearch service (by Elastic) doesn't allow this to be configured. Self hosted does, but I'm not yet familiar enough to configure that. So for Logstast, Beats or Kibana, you had to install a client certificate before Elasticsearch would accept those connections? |
|
Well, when I first installed SELKS 6, all apps were running and connecting without any issues. Then I enabled the X-Pack basic settings in Elasticsearch. First it was the basic authentication, with only username and password involved. All apps were able to connect to Elasticsearch. Finally I enabled the https access in Elasticsearch, and then all apps/client connecting to the node require a certificate. Kibana can use a PKCS12 certificate, while Logstash and the beats can read only PEM format. Without a certificate, the connection won't be allowed. |
|
I tested the new dev. It looks like Evebox still can't connect to Elasticsearch. |
|
Please, keep me posted about any progress. I am available for testing and sharing feedback. Thank you |
|
Does Or if not, |
|
It seems to work |
|
No, that didn't work. You should see some JSON data telling you to authenticate. Add |
|
|
I have to go now, but tomorrow morning I will be available again. Thank you for your help and dedication |
|
This line here is being truncated: Can you try running from the command line to get the complete output? |
|
|
Ok, in your evebox configuration, try specifying "https://localhost:9200" instead of "127.0.0.1". |
|
|
Looks like its working. I don't like that the hostnames need to match when using disable certificate checks, but that seems to be the case with the TLS library I use. I will look into that. |
|
Excellent! I could already verify that the Evebox page works and shows recent data, from today. I understand about the TLS verification, but I think it is already a secondary issue, and I trust you will be able to resolve it shortly. I think I can move on with what I have so far, but if you need help testing and feedback, count on me. As always, I greatly appreciate your help, interest and above all the promptness of your response. |
jasonish
changed the title
|
Closing this issue for now, as during this I did fix an issue connecting to self-signed certificates which was completely broken before. Now it works, but with caveats. Thanks! |
|
I chased down why this requires a hostname instead of an IP address... I use a pure Rust TLS library for this project instead of OpenSSL so I can easily build static binaries, as well as cross compile for ARM - for the best "just works" scenario without running into library issues. This library (rustls) in turn depends on some PKI library that doesn't support connecting to TLS by hostname, while OpenSSL does. I probably won't switch to OpenSSL for the builds I provide so I can keep the the "just works" approach. But may provide a simple build flag to use it for those who want to build their own EveBox. |
|
Good to know and thank you for sharing! 👍 |
Hi,
I am in the process of enabling security options on my ELK nodes. Started enabling X-Pack in ELK and had to reconfigure Evebox. Resolved in #143.
Now I am enabling TLS and HTTPS in ELK. Once enabled, Elasticsearch won't accept http connections.
I tried editing evebox.yml as follows, but it did not work.
Apparently it's failing the SSL handshake due to a wrong or missing certificate.
How can I have Evebox to use a certificate generated by Elasticsearch? Or if there is another way, please share the right config to use.
Thank you
ELK log output
The text was updated successfully, but these errors were encountered: