Elasticsearch未授权访问漏洞

1、编辑elasticsearch.yml配置文件，添加认证相关配置

vim elasticsearch.yml

xpack.security.enabled: true
xpack.license.self_generated.type: basic
xpack.security.transport.ssl.enabled: true

2、重启ElasticSearch

# 重启方式可能略微不同
systemctl restart elasticsearch

3、设置密码
执行设置用户名和密码的命令,这里需要为4个用户分别设置密码，elastic, kibana, logstash_system,beats_system

cd bin/
./elasticsearch-setup-passwords interactive

4、如果想要更新密码执行

curl -H "Content-Type:application/json" -XPOST -u elastic 'http://127.0.0.1:9200/_xpack/security/user/elastic/_password' -d '{ "password" : "XXXXXXXXXX" }'

5、访问验证

curl -u elastic:password 127.0.0.1:9200