Skip to content

Commit 3dc5192

Browse files
AntonEliatrastephen-crawfordvagimelinatebower
authored andcommitted
* expanding on TrustStore and KeyStore opensearch-project#4578 opensearch-project#4060 Signed-off-by: AntonEliatra <anton.rubin@eliatra.com> * expanding on TrustStore and KeyStore opensearch-project#4578 opensearch-project#4060 Signed-off-by: AntonEliatra <anton.rubin@eliatra.com> * Update generate-certificates.md Signed-off-by: AntonEliatra <anton.rubin@eliatra.com> * Update opensearch-keystore.md Signed-off-by: AntonEliatra <anton.rubin@eliatra.com> * Apply suggestions from code review Co-authored-by: Stephen Crawford <65832608+scrawfor99@users.noreply.github.com> Signed-off-by: AntonEliatra <anton.rubin@eliatra.com> * Update security-admin.md Signed-off-by: AntonEliatra <anton.rubin@eliatra.com> * Apply suggestions from code review Co-authored-by: Melissa Vagi <vagimeli@amazon.com> Signed-off-by: AntonEliatra <anton.rubin@eliatra.com> * Apply suggestions from code review Co-authored-by: Melissa Vagi <vagimeli@amazon.com> Signed-off-by: AntonEliatra <anton.rubin@eliatra.com> * Apply suggestions from code review Co-authored-by: Nathan Bower <nbower@amazon.com> Signed-off-by: AntonEliatra <anton.rubin@eliatra.com> --------- Signed-off-by: AntonEliatra <anton.rubin@eliatra.com> Co-authored-by: Stephen Crawford <65832608+scrawfor99@users.noreply.github.com> Co-authored-by: Melissa Vagi <vagimeli@amazon.com> Co-authored-by: Nathan Bower <nbower@amazon.com> Signed-off-by: Sagar Upadhyaya <sagar.upadhyaya.121@gmail.com>
1 parent 9544aaa commit 3dc5192

File tree

3 files changed

+67
-29
lines changed

3 files changed

+67
-29
lines changed

_security/configuration/generate-certificates.md

Lines changed: 29 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -128,7 +128,7 @@ openssl x509 -req -in node1.csr -CA root-ca.pem -CAkey root-ca-key.pem -CAcreate
128128
```
129129

130130

131-
## Sample script
131+
## Sample script to generate self-signed PEM certificates
132132

133133
If you already know the certificate details and don't want to specify them interactively, use the `-subj` option in your `root-ca.pem` and CSR commands. This script creates a root certificate, admin certificate, two node certificates, and a client certificate, all with an expiration dates of two years (730 days):
134134

@@ -174,6 +174,34 @@ rm client.csr
174174
rm client.ext
175175
```
176176

177+
## Sample script to convert PEM certificates to keystore and truststore files
178+
179+
You can use the following script to generate a keystore and a truststore from the previously generated PEM certificates:
180+
181+
```bash
182+
#!/bin/sh
183+
184+
# Convert node certificate
185+
cat root-ca.pem node1.pem node1-key.pem > combined-node1.pem
186+
echo "Enter password for node1-cert.p12"
187+
openssl pkcs12 -export -in combined-node1.pem -out node1-cert.p12 -name node1
188+
echo "Enter password for keystore.jks"
189+
keytool -importkeystore -srckeystore node1-cert.p12 -srcstoretype pkcs12 -destkeystore keystore.jks
190+
191+
# Convert admin certificate
192+
cat root-ca.pem admin.pem admin-key.pem > combined-admin.pem
193+
echo "Enter password for admin-cert.p12"
194+
openssl pkcs12 -export -in combined-admin.pem -out admin-cert.p12 -name admin
195+
echo "Enter password for keystore.jks"
196+
keytool -importkeystore -srckeystore admin-cert.p12 -srcstoretype pkcs12 -destkeystore keystore.jks
197+
198+
# Import certificates to truststore
199+
keytool -importcert -keystore truststore.jks -file root-ca.cer -storepass changeit -trustcacerts -deststoretype pkcs12
200+
201+
# Cleanup
202+
rm combined-admin.pem
203+
rm combined-node1.pem
204+
```
177205

178206
## Add distinguished names to opensearch.yml
179207

_security/configuration/opensearch-keystore.md

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,9 @@ nav_order: 50
99

1010
`opensearch-keystore` is a utility script used to manage an OpenSearch keystore. An OpenSearch keystore provides a secure method of storing sensitive information, such as passwords and keys, used in an OpenSearch cluster. The script allows you to securely create, list, add, and remove settings. It is included in the OpenSearch distribution.
1111

12+
This keystore is separate from the keystore and truststore used to store TLS certificates in JKS or PKCS12/PFX format in order to secure the transport and HTTP layers. For information about those keystores, refer to [Keystore and truststore files]({{site.url}}{{site.baseurl}}/security/configuration/tls/#keystore-and-truststore-files).
13+
{: .note}
14+
1215
## Usage
1316

1417
In order to use the `opensearch-keystore` script, you must have access to the file system containing the OpenSearch installation and the ability to execute OpenSearch scripts.
@@ -123,6 +126,9 @@ The following command removes a keystore setting:
123126

124127
No response exists for this command. To confirm that the setting was deleted, use `opensearch-keystore list`.
125128

126-
## KeyStore entries as OpenSearch settings
129+
For a complete list of secure settings that can be configured using `opensearch-keystore`, refer to [(Advanced) Using encrypted password settings for SSL]({{site.url}}{{site.baseurl}}/security/configuration/tls/#advanced-using-encrypted-password-settings-for-ssl).
130+
{: .note}
131+
132+
## Keystore entries as OpenSearch settings
127133

128134
After a setting has been added to a keystore, it is implicitly added to the OpenSearch configuration as if it were another entry in `opensearch.yml`. To modify a keystore entry use `./bin/opensearch-keystore upgrade <setting>`. To remove an entry, use `./bin/opensearch-keystore remove <setting>`.

_security/configuration/security-admin.md

Lines changed: 31 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,9 @@ The first job of the script is to initialize the `.opendistro_security` index. T
1818

1919
The script can be found at `/plugins/opensearch-security/tools/securityadmin.sh`. This is a relative path showing where the `securityadmin.sh` script is located. The absolute path depends on the directory where you've installed OpenSearch. For example, if you use Docker to install OpenSearch, the path will resemble the following: `/usr/share/opensearch/plugins/opensearch-security/tools/securityadmin.sh`.
2020

21+
The `securityadmin.sh` script requires SSL/TLS HTTP to be enabled for your OpenSearch cluster. Set `plugins.security.ssl.http.enabled: true` in your `opensearch.yml` file before proceeding. If your cluster does not use SSL/TLS on the HTTP layer but requires `securityadmin.sh`, enable SSL/TLS on a single node, such as the`ingest` node, and then run `securityadmin.sh` on that node. Enable this setting by configuring the [REST layer TLS]({{site.url}}{{site.baseurl}}/security/configuration/tls/#rest-layer-tls) settings on only one node. Restarting OpenSearch on that node is necessary following any change to the `opensearch.yml` file.
22+
{: .note}
23+
2124
## A word of caution
2225

2326
If you make changes to the configuration files in `config/opensearch-security`, OpenSearch does _not_ automatically apply these changes. Instead, you must run `securityadmin.sh` to load the updated files into the index.
@@ -86,8 +89,6 @@ You can't use node certificates as admin certificates. The two must be separate.
8689

8790
The `securityadmin.sh` tool can be run from any machine that has access to the HTTP port of your OpenSearch cluster (the default port is 9200). You can change the Security plugin configuration without having to access your nodes through SSH.
8891

89-
`securityadmin.sh` requires that SSL/TLS transport is enabled on your opensearch cluster. In other words, make sure that the `plugins.security.ssl.http.enabled: true` is set in `opensearch.yml` before proceeding.
90-
{: .note}
9192

9293
Each node also includes the tool at `plugins/opensearch-security/tools/securityadmin.sh`. You might need to make the script executable before running it:
9394

@@ -101,6 +102,8 @@ To print all available command line options, run the script with no arguments:
101102
./plugins/opensearch-security/tools/securityadmin.sh
102103
```
103104

105+
## Using `securityadmin` with PEM files
106+
104107
To load your initial configuration (all YAML files), you might use the following command:
105108

106109
```bash
@@ -124,6 +127,31 @@ Name | Description
124127
`-keypass` | The password of the private key of the admin certificate, if any.
125128
`-cacert` | The location of the PEM file containing the root certificate. You can use an absolute or relative path. Relative paths are resolved relative to the execution directory of `securityadmin.sh`.
126129

130+
## Using `securityadmin` with keystore and truststore files
131+
132+
JKS format keystore files are compatible with `securityadmin.sh`, as shown in the following example setting:
133+
134+
```bash
135+
./securityadmin.sh -cd ../../../config/opensearch-security -icl -nhnv
136+
-ts <path/to/truststore> -tspass <truststore password>
137+
-ks <path/to/keystore> -kspass <keystore password>
138+
```
139+
140+
Use the following options to control the keystore and truststore settings.
141+
142+
Name | Description
143+
:--- | :---
144+
`-ks` | The location of the keystore containing the admin certificate and all intermediate certificates, if any. You can use an absolute or relative path. Relative paths are resolved relative to the `securityadmin.sh` execution directory.
145+
`-kspass` | The keystore password.
146+
`-kst` | The keystore type, either JKS or PKCS#12/PFX. If not specified, the Security plugin tries to determine the type based on the file extension.
147+
`-ksalias` | The alias of the admin certificate, if any.
148+
`-ts` | The location of the truststore containing the root certificate. You can use an absolute or relative path. Relative paths are resolved relative to the `securityadmin.sh` execution directory.
149+
`-tspass` | The truststore password.
150+
`-tst` | The truststore type, either JKS or PKCS#12/PFX. If not specified, the Security plugin tries to determine the type based on the file extension.
151+
`-tsalias` | The alias for the root certificate, if any.
152+
153+
The certificate authority (CA) that signs the `admin` certificate can differ from the one used for signing transport or HTTP certificates. The CA does, however, need to be added to the truststore in order to validate the certificate. See [Generate node and client certificates]({{site.url}}{{site.baseurl}}/security/configuration/generate-certificates/#optional-generate-node-and-client-certificates) for more information.
154+
{: .note}
127155

128156
## Sample commands
129157

@@ -162,30 +190,6 @@ Apply all YAML files in `config/opensearch-security/` with keystore and truststo
162190
```
163191

164192

165-
## Using securityadmin with keystore and truststore files
166-
167-
You can also use keystore files in JKS format in conjunction with `securityadmin.sh`:
168-
169-
```bash
170-
./securityadmin.sh -cd ../../../config/opensearch-security -icl -nhnv
171-
-ts <path/to/truststore> -tspass <truststore password>
172-
-ks <path/to/keystore> -kspass <keystore password>
173-
```
174-
175-
Use the following options to control the key and truststore settings.
176-
177-
Name | Description
178-
:--- | :---
179-
`-ks` | The location of the keystore containing the admin certificate and all intermediate certificates, if any. You can use an absolute or relative path. Relative paths are resolved relative to the execution directory of `securityadmin.sh`.
180-
`-kspass` | The password for the keystore.
181-
`-kst` | The key store type, either JKS or PKCS#12/PFX. If not specified, the Security plugin tries to determine the type from the file extension.
182-
`-ksalias` | The alias of the admin certificate, if any.
183-
`-ts` | The location of the truststore containing the root certificate. You can use an absolute or relative path. Relative paths are resolved relative to the execution directory of `securityadmin.sh`.
184-
`-tspass` | The password for the truststore.
185-
`-tst` | The truststore type, either JKS or PKCS#12/PFX. If not specified, the Security plugin tries to determine the type from the file extension.
186-
`-tsalias` | The alias for the root certificate, if any.
187-
188-
189193
### OpenSearch settings
190194

191195
If you run a default OpenSearch installation, which listens on port 9200 and uses `opensearch` as a cluster name, you can omit the following settings altogether. Otherwise, specify your OpenSearch settings by using the following switches.
@@ -326,4 +330,4 @@ For example, to load your initial configuration (all YAML files), use the follow
326330
-cacert ..\..\..\config\root-ca.pem ^
327331
-cert ..\..\..\config\kirk.pem ^
328332
-key ..\..\..\config\kirk-key.pem
329-
```
333+
```

0 commit comments

Comments
 (0)