You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
## Sample script to generate self-signed PEM certificates
132
132
133
133
If you already know the certificate details and don't want to specify them interactively, use the `-subj` option in your `root-ca.pem` and CSR commands. This script creates a root certificate, admin certificate, two node certificates, and a client certificate, all with an expiration dates of two years (730 days):
134
134
@@ -174,6 +174,34 @@ rm client.csr
174
174
rm client.ext
175
175
```
176
176
177
+
## Sample script to convert PEM certificates to keystore and truststore files
178
+
179
+
You can use the following script to generate a keystore and a truststore from the previously generated PEM certificates:
Copy file name to clipboardExpand all lines: _security/configuration/opensearch-keystore.md
+7-1Lines changed: 7 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,6 +9,9 @@ nav_order: 50
9
9
10
10
`opensearch-keystore` is a utility script used to manage an OpenSearch keystore. An OpenSearch keystore provides a secure method of storing sensitive information, such as passwords and keys, used in an OpenSearch cluster. The script allows you to securely create, list, add, and remove settings. It is included in the OpenSearch distribution.
11
11
12
+
This keystore is separate from the keystore and truststore used to store TLS certificates in JKS or PKCS12/PFX format in order to secure the transport and HTTP layers. For information about those keystores, refer to [Keystore and truststore files]({{site.url}}{{site.baseurl}}/security/configuration/tls/#keystore-and-truststore-files).
13
+
{: .note}
14
+
12
15
## Usage
13
16
14
17
In order to use the `opensearch-keystore` script, you must have access to the file system containing the OpenSearch installation and the ability to execute OpenSearch scripts.
@@ -123,6 +126,9 @@ The following command removes a keystore setting:
123
126
124
127
No response exists for this command. To confirm that the setting was deleted, use `opensearch-keystore list`.
125
128
126
-
## KeyStore entries as OpenSearch settings
129
+
For a complete list of secure settings that can be configured using `opensearch-keystore`, refer to [(Advanced) Using encrypted password settings for SSL]({{site.url}}{{site.baseurl}}/security/configuration/tls/#advanced-using-encrypted-password-settings-for-ssl).
130
+
{: .note}
131
+
132
+
## Keystore entries as OpenSearch settings
127
133
128
134
After a setting has been added to a keystore, it is implicitly added to the OpenSearch configuration as if it were another entry in `opensearch.yml`. To modify a keystore entry use `./bin/opensearch-keystore upgrade <setting>`. To remove an entry, use `./bin/opensearch-keystore remove <setting>`.
Copy file name to clipboardExpand all lines: _security/configuration/security-admin.md
+31-27Lines changed: 31 additions & 27 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -18,6 +18,9 @@ The first job of the script is to initialize the `.opendistro_security` index. T
18
18
19
19
The script can be found at `/plugins/opensearch-security/tools/securityadmin.sh`. This is a relative path showing where the `securityadmin.sh` script is located. The absolute path depends on the directory where you've installed OpenSearch. For example, if you use Docker to install OpenSearch, the path will resemble the following: `/usr/share/opensearch/plugins/opensearch-security/tools/securityadmin.sh`.
20
20
21
+
The `securityadmin.sh` script requires SSL/TLS HTTP to be enabled for your OpenSearch cluster. Set `plugins.security.ssl.http.enabled: true` in your `opensearch.yml` file before proceeding. If your cluster does not use SSL/TLS on the HTTP layer but requires `securityadmin.sh`, enable SSL/TLS on a single node, such as the`ingest` node, and then run `securityadmin.sh` on that node. Enable this setting by configuring the [REST layer TLS]({{site.url}}{{site.baseurl}}/security/configuration/tls/#rest-layer-tls) settings on only one node. Restarting OpenSearch on that node is necessary following any change to the `opensearch.yml` file.
22
+
{: .note}
23
+
21
24
## A word of caution
22
25
23
26
If you make changes to the configuration files in `config/opensearch-security`, OpenSearch does _not_ automatically apply these changes. Instead, you must run `securityadmin.sh` to load the updated files into the index.
@@ -86,8 +89,6 @@ You can't use node certificates as admin certificates. The two must be separate.
86
89
87
90
The `securityadmin.sh` tool can be run from any machine that has access to the HTTP port of your OpenSearch cluster (the default port is 9200). You can change the Security plugin configuration without having to access your nodes through SSH.
88
91
89
-
`securityadmin.sh` requires that SSL/TLS transport is enabled on your opensearch cluster. In other words, make sure that the `plugins.security.ssl.http.enabled: true` is set in `opensearch.yml` before proceeding.
90
-
{: .note}
91
92
92
93
Each node also includes the tool at `plugins/opensearch-security/tools/securityadmin.sh`. You might need to make the script executable before running it:
93
94
@@ -101,6 +102,8 @@ To print all available command line options, run the script with no arguments:
To load your initial configuration (all YAML files), you might use the following command:
105
108
106
109
```bash
@@ -124,6 +127,31 @@ Name | Description
124
127
`-keypass`| The password of the private key of the admin certificate, if any.
125
128
`-cacert`| The location of the PEM file containing the root certificate. You can use an absolute or relative path. Relative paths are resolved relative to the execution directory of `securityadmin.sh`.
126
129
130
+
## Using `securityadmin` with keystore and truststore files
131
+
132
+
JKS format keystore files are compatible with `securityadmin.sh`, as shown in the following example setting:
Use the following options to control the keystore and truststore settings.
141
+
142
+
Name | Description
143
+
:--- | :---
144
+
`-ks`| The location of the keystore containing the admin certificate and all intermediate certificates, if any. You can use an absolute or relative path. Relative paths are resolved relative to the `securityadmin.sh` execution directory.
145
+
`-kspass`| The keystore password.
146
+
`-kst`| The keystore type, either JKS or PKCS#12/PFX. If not specified, the Security plugin tries to determine the type based on the file extension.
147
+
`-ksalias`| The alias of the admin certificate, if any.
148
+
`-ts`| The location of the truststore containing the root certificate. You can use an absolute or relative path. Relative paths are resolved relative to the `securityadmin.sh` execution directory.
149
+
`-tspass`| The truststore password.
150
+
`-tst`| The truststore type, either JKS or PKCS#12/PFX. If not specified, the Security plugin tries to determine the type based on the file extension.
151
+
`-tsalias`| The alias for the root certificate, if any.
152
+
153
+
The certificate authority (CA) that signs the `admin` certificate can differ from the one used for signing transport or HTTP certificates. The CA does, however, need to be added to the truststore in order to validate the certificate. See [Generate node and client certificates]({{site.url}}{{site.baseurl}}/security/configuration/generate-certificates/#optional-generate-node-and-client-certificates) for more information.
154
+
{: .note}
127
155
128
156
## Sample commands
129
157
@@ -162,30 +190,6 @@ Apply all YAML files in `config/opensearch-security/` with keystore and truststo
162
190
```
163
191
164
192
165
-
## Using securityadmin with keystore and truststore files
166
-
167
-
You can also use keystore files in JKS format in conjunction with `securityadmin.sh`:
Use the following options to control the key and truststore settings.
176
-
177
-
Name | Description
178
-
:--- | :---
179
-
`-ks`| The location of the keystore containing the admin certificate and all intermediate certificates, if any. You can use an absolute or relative path. Relative paths are resolved relative to the execution directory of `securityadmin.sh`.
180
-
`-kspass`| The password for the keystore.
181
-
`-kst`| The key store type, either JKS or PKCS#12/PFX. If not specified, the Security plugin tries to determine the type from the file extension.
182
-
`-ksalias`| The alias of the admin certificate, if any.
183
-
`-ts`| The location of the truststore containing the root certificate. You can use an absolute or relative path. Relative paths are resolved relative to the execution directory of `securityadmin.sh`.
184
-
`-tspass`| The password for the truststore.
185
-
`-tst`| The truststore type, either JKS or PKCS#12/PFX. If not specified, the Security plugin tries to determine the type from the file extension.
186
-
`-tsalias`| The alias for the root certificate, if any.
187
-
188
-
189
193
### OpenSearch settings
190
194
191
195
If you run a default OpenSearch installation, which listens on port 9200 and uses `opensearch` as a cluster name, you can omit the following settings altogether. Otherwise, specify your OpenSearch settings by using the following switches.
@@ -326,4 +330,4 @@ For example, to load your initial configuration (all YAML files), use the follow
0 commit comments