cfssl生成证书

wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64 -O     /usr/local/bin/cfsslwget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64 -O      /usr/local/bin/cfssljsonwget https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64 -O /usr/local/bin/cfssl-certinfochmod +x /usr/local/bin/cfssl*cd;mkdir keys;cd keyscat > ca-config.json <
    
      ca-csr.json <
     
       app-csr.json <
     
    

可以看到san里包含了n1 和 n2的ip. 这里计划logstash(的ip)和filebeat(的ip)使用同一套证书

实验环境

logstash&filebeat之间传数据-明文

logstash配置

cat > pipeline.conf <
    
      5044  }    stdin {    codec => "json"  }}output {  stdout { codec => rubydebug }}EOFbin/logstash -f pipeline.conf --config.reload.automatic
    

filebeat多输入(不能多输出)参考:

cat > filebeat.yml <

测试文字

helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld helloworld

wireshark抓包: 不加密的时候,可以看到这玩意依稀可以看到依稀传输内容,如果互联网传输的话会有隐患.

logstash&filebeat之间传数据-ssl加密

• logstash配置ssl

参考:

cat > pipeline.conf <
    
      5044    ssl => true    ssl_certificate_authorities => ["/root/keys/ca.pem"]    ssl_certificate => "/root/keys/app.pem"    ssl_key => "/root/keys/app-key.pem"    ssl_verify_mode => "force_peer"  }    stdin {    codec => "json"  }}output {  stdout { codec => rubydebug }}EOFbin/logstash -f pipeline.conf --config.reload.automatic
    

• filebeat配置ssl

filebeat.prospectors:- type: log  enabled: true  paths:    - /tmp/ma.txt    output.logstash:  hosts: ["192.168.1.12:5043"]output.logstash.ssl.certificate_authorities: ["/root/keys/ca.pem"]output.logstash.ssl.certificate: "/root/keys/app.pem"output.logstash.ssl.key: "/root/keys/app-key.pem"output.console:  pretty: true  ./filebeat -e -c filebeat.yml -d "publish"

wireshark抓包: 看不到任何传输内容,依稀看到证书的subject(公开的).

报错doesn't contain any IP SANs

2017/12/24 02:33:59.242540 output.go:74: ERR Failed to connect: x509: cannot validate certificate for 192.168.1.11 because it doesn't contain any IP SANs2017/12/24 02:34:15.289558 output.go:74: ERR Failed to connect: x509: cannot validate certificate for 192.168.1.11 because it doesn't contain any IP SANs

ssl验证流程:

报错原因: 我生成证书请求的时候 hosts字段(即san)为空.

cd /root/keyscat > app-csr.json <