SSL Issue !!! #345
Labels
question
Further information is requested
Comments
|
I don't think there is a control value of "yes" in the "verify_certs" setting. There is no verify_certs in the api.config.json configuration |
|
chmod 777 rules rule_templates /home/user/dkwork2/es2
|--.env
|--config
| |--api.config.json
| |--elastalert.yaml
|--create-certs.yml
|--docker-compose-praeco.yml
|--docker-compose.yml
|--instances.yml
|--nginx_config
| |--default.conf
| |--nginx.conf
|--public
| |--praeco.config.json
|--rule_templates
|--rules.env COMPOSE_PROJECT_NAME=es
CERTS_DIR=/usr/share/elasticsearch/config/certificates
ELASTIC_PASSWORD=PleaseChangeMeconfig/api.config.json {
"appName": "elastalert-server",
"port": 3030,
"wsport": 3333,
"elastalertPath": "/opt/elastalert",
"verbose": false,
"es_debug": false,
"debug": false,
"rulesPath": {
"relative": true,
"path": "/rules"
},
"templatesPath": {
"relative": true,
"path": "/rule_templates"
},
"es_host": "es01",
"es_port": 9200,
"es_username": "elastic",
"es_password": "xxxxxxxxx
",
"es_ca_certs": "/usr/share/elasticsearch/config/certificates/ca/ca.crt",
"es_client_cert": "/usr/share/elasticsearch/config/certificates/es01/es01.crt",
"es_client_key": "/usr/share/elasticsearch/config/certificates/es01/es01.key",
"es_ssl": true,
"writeback_index": "praeco_elastalert_status"
}
config/elastalert.yaml # The elasticsearch hostname for metadata writeback
# Note that every rule can have its own elasticsearch host
es_host: es01
# The elasticsearch port
es_port: 9200
# This is the folder that contains the rule yaml files
# Any .yaml file will be loaded as a rule
rules_folder: rules
# How often ElastAlert will query elasticsearch
# The unit can be anything from weeks to seconds
run_every:
seconds: 60
# ElastAlert will buffer results from the most recent
# period of time, in case some log sources are not in real time
buffer_time:
minutes: 1
# Optional URL prefix for elasticsearch
#es_url_prefix: elasticsearch
# Connect with TLS to elasticsearch
use_ssl: True
# Verify TLS certificates
#verify_certs: True
# GET request with body is the default option for Elasticsearch.
# If it fails for some reason, you can pass 'GET', 'POST' or 'source'.
# See http://elasticsearch-py.readthedocs.io/en/master/connection.html?highlight=send_get_body_as#transport
# for details
#es_send_get_body_as: GET
# Option basic-auth username and password for elasticsearch
es_username: elastic
es_password: xxxxxxxxx
# ssl
ca_certs: /usr/share/elasticsearch/config/certificates/ca/ca.crt
client_cert: /usr/share/elasticsearch/config/certificates/es01/es01.crt
client_key: /usr/share/elasticsearch/config/certificates/es01/es01.key
# The index on es_host which is used for metadata storage
# This can be a unmapped index, but it is recommended that you run
# elastalert-create-index to set a mapping
writeback_index: praeco_elastalert_status
# If an alert fails for some reason, ElastAlert will retry
# sending the alert until this time period has elapsed
alert_time_limit:
days: 2
skip_invalid: Truecreate-certs.yml version: '2.2'
services:
create_certs:
container_name: create_certs
image: docker.elastic.co/elasticsearch/elasticsearch:7.10.0
command: >
bash -c '
if [[ ! -f /certs/bundle.zip ]]; then
bin/elasticsearch-certutil cert --silent --pem --in config/certificates/instances.yml -out /certs/bundle.zip;
unzip /certs/bundle.zip -d /certs;
fi;
chown -R 1000:0 /certs
'
user: "0"
working_dir: /usr/share/elasticsearch
volumes: ['certs:/certs', '.:/usr/share/elasticsearch/config/certificates']
volumes: {"certs"}instances.yml instances:
- name: es01
dns:
- es01
- localhost
ip:
- 127.0.0.1
#- name: es02
# dns:
# - es02
# - localhost
# ip:
# - 127.0.0.1docker-compose.yml version: '2.2'
services:
es01:
container_name: es01
image: docker.elastic.co/elasticsearch/elasticsearch:7.10.0
environment:
- discovery.type=single-node
- cluster.name=es01
#- node.name=es01
#- discovery.seed_hosts=es01,es02
#- cluster.initial_master_nodes=es01,es02
- network.host=0.0.0.0
- ELASTIC_PASSWORD=$ELASTIC_PASSWORD
- "ES_JAVA_OPTS=-Xms256m -Xmx256m"
- xpack.license.self_generated.type=trial
- xpack.security.enabled=true
- xpack.security.http.ssl.enabled=true
- xpack.security.http.ssl.key=$CERTS_DIR/es01/es01.key
- xpack.security.http.ssl.certificate_authorities=$CERTS_DIR/ca/ca.crt
- xpack.security.http.ssl.certificate=$CERTS_DIR/es01/es01.crt
- xpack.security.transport.ssl.enabled=true
- xpack.security.transport.ssl.verification_mode=certificate
- xpack.security.transport.ssl.certificate_authorities=$CERTS_DIR/ca/ca.crt
- xpack.security.transport.ssl.certificate=$CERTS_DIR/es01/es01.crt
- xpack.security.transport.ssl.key=$CERTS_DIR/es01/es01.key
volumes: ['data01:/usr/share/elasticsearch/data', 'certs:$CERTS_DIR']
ports:
- 9200:9200
healthcheck:
test: curl --cacert $CERTS_DIR/ca/ca.crt -s https://localhost:9200 >/dev/null; if [[ $$? == 52 ]]; then echo 0; else echo 1; fi
interval: 30s
timeout: 10s
retries: 5
volumes: {"data01", "certs"}docker-compose-praeco.yml version: '3'
services:
elastalert:
image: 'praecoapp/elastalert-server'
ports:
- 3030:3030
- 3333:3333
volumes:
- ./config/elastalert.yaml:/opt/elastalert/config.yaml
- ./config/api.config.json:/opt/elastalert-server/config/config.json
- ./rules:/opt/elastalert/rules
- ./rule_templates:/opt/elastalert/rule_templates
- certs:/usr/share/elasticsearch/config/certificates
#extra_hosts:
# - 'elasticsearch:${PRAECO_ELASTICSEARCH}'
tty: true
networks:
- default
- es_default
webapp:
image: 'praecoapp/praeco'
ports:
- 8080:8080
volumes:
- ./public/praeco.config.json:/var/www/html/praeco.config.json
- ./nginx_config/nginx.conf:/etc/nginx/nginx.conf
- ./nginx_config/default.conf:/etc/nginx/conf.d/default.conf
- certs:/usr/share/elasticsearch/config/certificates
tty: true
networks:
- default
- es_default
volumes: { "certs" }
networks:
es_default:
external: true |
|
I wonder if adding "pip install certifi" will solve the problem. I would like to check the operation in the same state and see if the workaround is effective, so please tell me how you are building the environment. The same state cannot be reproduced without information. Am I the only one who sees what you posted as elastalert.yaml in api.config.json? |
|
@nsano-rururu thank you soooooooo much :) |
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Hi dears
I have a big problem with elast alert praeco as bellow:
Traceback (most recent call last):
File "/home/node/.local/lib/python3.8/site-packages/elasticsearch/connection/http_requests.py", line 77, in perform_request
response = self.session.send(prepared_request, **send_kwargs)
File "/usr/lib/python3.8/site-packages/requests/sessions.py", line 643, in send
r = adapter.send(request, **kwargs)
File "/usr/lib/python3.8/site-packages/requests/adapters.py", line 514, in send
raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='node1.elastic.ir', port=9200): Max retries exceeded with url: / (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1123)')))
my elastalert.yaml :
{
"appName": "elastalert-server",
"port": 3030,
"wsport": 3333,
"elastalertPath": "/opt/elastalert",
"verbose": true,
"es_debug": false,
"debug": false,
"rulesPath": {
"relative": true,
"path": "/rules"
},
"templatesPath": {
"relative": true,
"path": "/rule_templates"
},
"es_host": "172.31.25.25",
"es_port": 9200,
"es_username": "elastic",
"es_password": "My_Password",
"es_ssl": true,
"es_client_key": "/opt/elastalert/certs/node1.key",
"es_client_cert": "/opt/elastalert/certs/node1.crt",
"es_ca_cert": "/opt/elastalert/certs/ca.crt",
"verify_certs": yes,
"writeback_index": "praeco_elastalert_status"
}
Could you please help me
The text was updated successfully, but these errors were encountered: