OpenSearch 3.7.0 单机二进制部署与全链路 TLS 安全加固指南#

# 设置主机名
sudo hostnamectl set-hostname opensearch-singleone

# 修改 /etc/hosts 文件，添加主机名解析
sudo bash -c 'echo "127.0.1.1 opensearch-singleone" >> /etc/hosts'

# 临时关闭
sudo swapoff -a

# 永久关闭：注释掉 /etc/fstab 中的 swap 行
sudo cp /etc/fstab /etc/fstab.bak
sudo sed -i '/swap/s/^/#/' /etc/fstab

# 验证
free -h | grep Swap # 预期输出：Swap: 0B 0B 0B

# 创建并启用服务
sudo tee /etc/systemd/system/disable-thp.service > /dev/null << 'EOF'
[Unit]
Description=Disable Transparent Huge Pages
DefaultDependencies=false
After=sysinit.target local-fs.target

[Service]
Type=oneshot
ExecStart=/bin/bash -c 'echo never > /sys/kernel/mm/transparent_hugepage/enabled && echo never > /sys/kernel/mm/transparent_hugepage/defrag'

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl daemon-reload
sudo systemctl enable disable-thp.service --now

sudo tee /etc/sysctl.d/90-opensearch.conf > /dev/null << 'EOF'
# OpenSearch 核心调优
vm.max_map_count=262144
vm.swappiness=1
vm.dirty_background_ratio=5
vm.dirty_ratio=30
vm.dirty_expire_centisecs=500
vm.dirty_writeback_centisecs=100
vm.min_free_kbytes=524288

# 网络队列与连接限制
net.ipv4.tcp_max_syn_backlog=65535
net.core.somaxconn=65535
net.ipv4.tcp_rmem=4096 87380 67108864
net.ipv4.tcp_wmem=4096 65536 67108864
net.ipv4.tcp_fin_timeout=15
net.ipv4.tcp_keepalive_time=600
net.ipv4.tcp_keepalive_intvl=60
net.ipv4.tcp_keepalive_probes=5

# 文件句柄数
fs.file-max=655350
EOF

# 使配置生效
sudo sysctl -p /etc/sysctl.d/90-opensearch.conf

sudo groupadd -r opensearch
sudo useradd -r -s /usr/sbin/nologin -g opensearch opensearch

# 查看磁盘信息及新添加的磁盘
lsblk

# 预期输出示例：
NAME              MAJ:MIN RM  SIZE RO TYPE MOUNTPOINTS
fd0                 2:0    1    4K  0 disk 
sda                 8:0    0  100G  0 disk 
├─sda1              8:1    0    1M  0 part 
├─sda2              8:2    0    5G  0 part 
├─sda3              8:3    0    1G  0 part /boot
└─sda4              8:4    0   94G  0 part 
sdb                 8:16   0  500G  0 disk # <-- 新添加的虚拟 SSD 磁盘

# 对新磁盘创建物理卷
sudo pvcreate /dev/sdb

# 验证 PV 创建成功
sudo pvs
sudo pvdisplay /dev/sdb

# 创建卷组 datavg，使用 /dev/sdb 作为物理卷
sudo vgcreate datavg /dev/sdb

# 验证 VG 创建成功
sudo vgs
sudo vgdisplay datavg

# 将卷组中全部空间分配给逻辑卷 datalv
sudo lvcreate -l 100%FREE -n datalv datavg

# 验证 LV 创建成功
sudo lvs
sudo lvdisplay datavg/datalv

# 使用 mkfs.xfs 格式化逻辑卷
sudo mkfs.xfs -f /dev/datavg/datalv

# 验证文件系统类型
sudo blkid /dev/datavg/datalv
# 预期输出中包含 type="xfs"

# 创建挂载点目录
sudo mkdir -p /data1/opensearch

# 临时挂载
sudo mount /dev/datavg/datalv /data1/opensearch

# 验证挂载状态
df -hT /data1/opensearch
# 预期输出：文件系统类型 xfs，容量为磁盘总容量

# 获取逻辑卷的 UUID
sudo blkid /dev/datavg/datalv
# 预期输出示例：
# /dev/datavg/datalv: UUID="372c6321-4b47-473a-817c-9ded36403168" TYPE="xfs"

sudo cp /etc/fstab /etc/fstab.bak
# 将挂载信息写入 /etc/fstab（使用 UUID 方式，更安全可靠）
echo 'UUID=372c6321-4b47-473a-817c-9ded36403168 /data1/opensearch xfs defaults,noatime 0 0' | sudo tee -a /etc/fstab

# 验证 /etc/fstab 配置
cat /etc/fstab

# 测试挂载配置是否正确（不会实际挂载）
sudo mount -o remount /data1/opensearch
systemctl daemon-reload

# 设置 OpenSearch 数据目录所有者和权限
sudo chown -R opensearch:opensearch /data1/opensearch
sudo chmod -R 755 /data1/opensearch

# 验证权限
ls -ld /data1/opensearch

# 创建安装根目录
sudo mkdir -p /opt/soft/opensearch

# 创建数据和日志目录
sudo mkdir -p /data1/opensearch
sudo mkdir -p /var/log/opensearch

# 创建配置目录
sudo mkdir -p /etc/opensearch
sudo mkdir -p /etc/opensearch-dashboards

cd /tmp

# 下载 OpenSearch
curl -LO https://artifacts.opensearch.org/releases/bundle/opensearch/3.7.0/opensearch-3.7.0-linux-x64.tar.gz

# 下载 OpenSearch Dashboards
curl -LO https://artifacts.opensearch.org/releases/bundle/opensearch-dashboards/3.7.0/opensearch-dashboards-3.7.0-linux-x64.tar.gz

# 解压到安装目录
tar -xzf opensearch-3.7.0-linux-x64.tar.gz -C /opt/soft/opensearch
tar -xzf opensearch-dashboards-3.7.0-linux-x64.tar.gz -C /opt/soft/opensearch

# 创建符号链接（便于版本升级）
ln -snf opensearch-3.7.0 /opt/soft/opensearch/opensearch
ln -snf opensearch-dashboards-3.7.0 /opt/soft/opensearch/opensearch-dashboards

# 拷贝配置文件到 /etc/
cp -r /opt/soft/opensearch/opensearch/config/* /etc/opensearch/
cp -r /opt/soft/opensearch/opensearch-dashboards/config/* /etc/opensearch-dashboards/

# 设置目录权限
sudo chown -R opensearch:opensearch /opt/soft/opensearch
sudo chown -R opensearch:opensearch /etc/opensearch
sudo chown -R opensearch:opensearch /etc/opensearch-dashboards
sudo chown -R opensearch:opensearch /var/log/opensearch
sudo chown -R opensearch:opensearch /data1/opensearch

[Unit]
Description=OpenSearch
Documentation=https://opensearch.org/

Wants=network-online.target
After=network-online.target

[Service]
Type=notify
RuntimeDirectory=opensearch
PrivateTmp=true
ExecStartPre=/usr/bin/mkdir -p /var/run/opensearch
ExecStartPre=/usr/bin/chown -R opensearch:opensearch /var/run/opensearch
ExecStartPre=/usr/bin/chmod 755 /var/run/opensearch
Environment="OPENSEARCH_HOME=/opt/soft/opensearch/opensearch"
Environment="LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/opt/soft/opensearch/opensearch/plugins/opensearch-knn/lib"
Environment="OPENSEARCH_JAVA_HOME=/opt/soft/opensearch/opensearch/jdk"
Environment="OPENSEARCH_PATH_CONF=/etc/opensearch"
Environment="PID_DIR=/var/run/opensearch"
Environment="OPENSEARCH_STARTUP_SLEEP_TIME=5"
Environment="OPENSEARCH_SD_NOTIFY=true"
WorkingDirectory=/opt/soft/opensearch/opensearch
User=opensearch
Group=opensearch
ExecStart=/opt/soft/opensearch/opensearch/bin/opensearch -p ${PID_DIR}/opensearch.pid

# StandardOutput is configured to redirect to journalctl since
# some error messages may be logged in standard output before
# opensearch logging system is initialized. OpenSearch
# stores its logs in /var/log/opensearch and does not use
# journalctl by default. If you also want to enable journalctl
# logging, you can simply remove the "quiet" option from ExecStart.
StandardOutput=journal
StandardError=inherit

LimitNOFILE=262144
LimitMEMLOCK=infinity
LimitCORE=1879040192

# Specifies the maximum number of processes
LimitNPROC=64133

# Specifies the maximum size of virtual memory
LimitAS=infinity

# Specifies the maximum file size
LimitFSIZE=infinity

# Disable timeout logic and wait until process is stopped
TimeoutStopSec=0

# SIGTERM signal is used to stop the Java process
KillSignal=SIGTERM

# Send the signal only to the JVM rather than its control group
KillMode=process

# Java process is never killed
SendSIGKILL=no

# When a JVM receives a SIGTERM signal it exits with code 143
SuccessExitStatus=143

TimeoutStartSec=75


[Install]
WantedBy=multi-user.target

[Unit]
Description=opensearch-dashboards
Wants=network-online.target
After=network-online.target

[Service]
RuntimeDirectory=opensearch-dashboards
PrivateTmp=true
Environment="OSD_PATH_CONF=/etc/opensearch-dashboards"
WorkingDirectory=/opt/soft/opensearch/opensearch-dashboards
User=opensearch
Group=opensearch
ExecStart=/opt/soft/opensearch/opensearch-dashboards/bin/opensearch-dashboards
Restart=always
StandardOutput=journal
StandardError=inherit

# Specifies the maximum file descriptor number that can be opened by this process
LimitNOFILE=65536

# Specifies the maximum number of processes
LimitNPROC=4096

# Specifies the maximum size of virtual memory
LimitAS=infinity

# Specifies the maximum file size
LimitFSIZE=infinity

# Disable timeout logic and wait until process is stopped
TimeoutStopSec=0

# SIGTERM signal is used to stop the Java process
KillSignal=SIGTERM

# Send the signal only to the JVM rather than its control group
KillMode=process

# Java process is never killed
SendSIGKILL=no

# When a JVM receives a SIGTERM signal it exits with code 143
SuccessExitStatus=143

[Install]
WantedBy=multi-user.target

# 重新加载 systemd 配置（任何时候修改服务文件后都应执行）
sudo systemctl daemon-reload

# 启用服务（开机自启动）
sudo systemctl enable opensearch opensearch-dashboards

-Xms24g
-Xmx24g
-XX:HeapDumpPath=/var/log/opensearch
-XX:ErrorFile=/var/log/opensearch/hs_err_pid%p.log

# ======================== OpenSearch Configuration =========================

# ---------------------------------- Cluster -----------------------------------
cluster.name: opensearch-singleone

# ------------------------------------ Node ------------------------------------
node.name: opensearch-singleone
node.roles: [ cluster_manager, data, ingest ]

# ------------------------------------ Paths -----------------------------------
path.data: /data1/opensearch
path.logs: /var/log/opensearch

# ----------------------------------- Memory -----------------------------------
bootstrap.memory_lock: true
bootstrap.system_call_filter: true

# ---------------------------------- Network -----------------------------------
network.bind_host: [ "127.0.0.1", "本机IP" ]
network.publish_host: "本机IP"
http.port: 9200
transport.port: 9300

# --------------------------------- Discovery ----------------------------------
discovery.type: single-node

mkdir -p /root/opensearch_pki && cd /root/opensearch_pki

# 生成 CA 私钥
openssl genrsa -out root-ca-key.pem 2048

# 生成自签名 Root CA 证书 (有效期 3 年)
openssl req -new -x509 -sha256 -key root-ca-key.pem -out root-ca.pem -days 1095 \
  -subj "/C=CN/ST=SC/L=CD/O=OS/OU=SEC/CN=OS-ROOT-CA"

HOSTNAME=$(hostname)
NODE_IP="本机IP"

# 1. 创建 SAN 扩展配置文件
cat <<EOF > node_ext.cnf
authorityKeyIdentifier=keyid,issuer
basicConstraints=critical,CA:FALSE
keyUsage = critical, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth, clientAuth
subjectAltName = @alt_names

[alt_names]
DNS.1 = localhost
DNS.2 = ${HOSTNAME}
IP.1 = 127.0.0.1
IP.2 = ${NODE_IP}
EOF

# 2. 生成私钥 (PKCS#8 格式)
openssl genrsa -out ${HOSTNAME}-key-temp.pem 2048
openssl pkcs8 -inform PEM -outform PEM -in ${HOSTNAME}-key-temp.pem -topk8 -nocrypt -out ${HOSTNAME}-key.pem
rm -f ${HOSTNAME}-key-temp.pem

# 3. 生成 CSR 并签署
openssl req -new -key ${HOSTNAME}-key.pem -out ${HOSTNAME}.csr \
  -subj "/C=CN/ST=SC/L=CD/O=OS/OU=SEC/CN=${HOSTNAME}"

openssl x509 -req -in ${HOSTNAME}.csr -CA root-ca.pem -CAkey root-ca-key.pem \
  -CAcreateserial -sha256 -out ${HOSTNAME}.pem -days 1095 -extfile node_ext.cnf

# 4. 清理
rm -f ${HOSTNAME}.csr node_ext.cnf

# 生成 Admin 私钥
openssl genrsa -out admin-key-temp.pem 2048
openssl pkcs8 -inform PEM -outform PEM -in admin-key-temp.pem -topk8 -nocrypt -out admin-key.pem
rm -f admin-key-temp.pem

# 生成 CSR 并签署
openssl req -new -key admin-key.pem -out admin.csr \
  -subj "/C=CN/ST=SC/L=CD/O=OS/OU=SEC/CN=ADMIN"

openssl x509 -req -in admin.csr -CA root-ca.pem -CAkey root-ca-key.pem \
  -CAcreateserial -sha256 -out admin.pem -days 1095

rm -f admin.csr

# 1. 创建客户端 SAN 配置
cat <<EOF > client-san.cnf
[req]
distinguished_name = req_distinguished_name
req_extensions = v3_req
prompt = no
[req_distinguished_name]
C = CN
ST = BJ
L = BJ
O = SIEM
OU = SEC
CN = opensearch-dashboard-client
[v3_req]
keyUsage = critical, digitalSignature, keyEncipherment
extendedKeyUsage = clientAuth
subjectAltName = @alt_names
[alt_names]
DNS.1 = localhost
DNS.2 = ${HOSTNAME}
IP.1 = 127.0.0.1
IP.2 = ${NODE_IP}
EOF

# 2. 生成证书
openssl genrsa -out client-san-key.pem 2048
openssl req -new -key client-san-key.pem -out client-san.csr -config client-san.cnf
openssl x509 -req -in client-san.csr -CA root-ca.pem -CAkey root-ca-key.pem \
  -CAcreateserial -sha256 -out client-san.pem -days 1095 -extensions v3_req -extfile client-san.cnf

# 3. 清理
rm -f client-san.csr client-san.cnf

cd /root/opensearch_pki

# 分发到 OpenSearch 目录
sudo cp root-ca.pem /etc/opensearch/
sudo cp ${HOSTNAME}.pem /etc/opensearch/siem-mon-opensearch.pem
sudo cp ${HOSTNAME}-key.pem /etc/opensearch/siem-mon-opensearch-key.pem
sudo cp admin.pem /etc/opensearch/
sudo cp admin-key.pem /etc/opensearch/

# 设置权限 (OpenSearch)
sudo chown opensearch:opensearch /etc/opensearch/*.pem
sudo chmod 644 /etc/opensearch/root-ca.pem /etc/opensearch/admin.pem
sudo chmod 600 /etc/opensearch/siem-mon-opensearch-key.pem /etc/opensearch/admin-key.pem

# 分发到 Dashboard 目录
sudo cp root-ca.pem /etc/opensearch-dashboards/
sudo cp client-san.pem /etc/opensearch-dashboards/dashboard.pem
sudo cp client-san-key.pem /etc/opensearch-dashboards/dashboard-key.pem
sudo cp client-san.pem /etc/opensearch-dashboards/client-san.pem
sudo cp client-san-key.pem /etc/opensearch-dashboards/client-san-key.pem

# 设置权限 (Dashboard)
sudo chown opensearch:opensearch /etc/opensearch-dashboards/*.pem
sudo chmod 644 /etc/opensearch-dashboards/root-ca.pem /etc/opensearch-dashboards/dashboard.pem
sudo chmod 600 /etc/opensearch-dashboards/dashboard-key.pem /etc/opensearch-dashboards/client-san-key.pem

# ====================================================================
# OpenSearch 安全插件 TLS 配置
# ====================================================================

# 激活安全插件
plugins.security.disabled: false

# Transport 层 TLS (9300 端口)
transport.ssl.enforce_hostname_verification: true
plugins.security.ssl.transport.pemtrustedcas_filepath: /etc/opensearch/root-ca.pem
plugins.security.ssl.transport.pemcert_filepath: /etc/opensearch/siem-mon-opensearch.pem
plugins.security.ssl.transport.pemkey_filepath: /etc/opensearch/siem-mon-opensearch-key.pem

# HTTP 层 TLS (9200 端口)
plugins.security.ssl.http.enabled: true
plugins.security.ssl.http.pemtrustedcas_filepath: /etc/opensearch/root-ca.pem
plugins.security.ssl.http.pemcert_filepath: /etc/opensearch/siem-mon-opensearch.pem
plugins.security.ssl.http.pemkey_filepath: /etc/opensearch/siem-mon-opensearch-key.pem

# 初始化安全索引
plugins.security.allow_default_init_securityindex: true

# Admin 管理员 DN 白名单
plugins.security.authcz.admin_dn:
  - "CN=ADMIN,OU=SEC,O=OS,L=CD,ST=SC,C=CN"

# 节点 DN 白名单
plugins.security.nodes_dn:
  - "CN=${HOSTNAME}*,OU=SEC,O=OS,L=CD,ST=SC,C=CN"

# 其他安全配置
plugins.security.audit.type: internal_opensearch
plugins.security.enable_snapshot_restore_privilege: true
plugins.security.check_snapshot_restore_write_privileges: true
plugins.security.restapi.roles_enabled: [ "all_access", "security_rest_api_access" ]

# 1. 给 hash.sh 添加执行权限
chmod 755 /opt/soft/opensearch/opensearch/plugins/opensearch-security/tools/*.sh

# 2. 设置 JAVA_HOME
export OPENSEARCH_JAVA_HOME=/opt/soft/opensearch/opensearch/jdk

# 3. 生成密码 Hash（-p 指定密码）
/opt/soft/opensearch/opensearch/plugins/opensearch-security/tools/hash.sh \
  -p 'Admin@123!Secure'

sudo vim /etc/opensearch/opensearch-security/internal_users.yml

---
admin:
  hash: "<your_generated_hash>"
  reserved: true
  backend_roles:
    - "admin"
  description: "Super Admin User"

# 1. 启动 OpenSearch 服务
sudo systemctl start opensearch

# 2. 检查服务状态，确保启动成功
sudo systemctl status opensearch

# 3. 等待 OpenSearch 完全启动（约 30-60 秒）
sleep 60

# 4. 确认 9200 端口已监听
ss -tlnp | grep 9200

# 5. 设置 JAVA_HOME
export OPENSEARCH_JAVA_HOME=/opt/soft/opensearch/opensearch/jdk

# 6. 执行安全配置初始化
/opt/soft/opensearch/opensearch/plugins/opensearch-security/tools/securityadmin.sh \
  -cd /etc/opensearch/opensearch-security \
  -icl -nhnv \
  -cacert /etc/opensearch/root-ca.pem \
  -cert /etc/opensearch/admin.pem \
  -key /etc/opensearch/admin-key.pem \
  -h localhost

# 7. 确认初始化成功（输出中出现 Done with success 字样）
Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ...
...
Done with success

# 8. 重启 OpenSearch 使安全配置生效
sudo systemctl restart opensearch

# 9. 确认服务重启成功
sudo systemctl status opensearch

# 10. 等待服务完全启动
sleep 30

# ======================== OpenSearch Dashboards Configuration =========================

# Server
server.host: "0.0.0.0"
server.port: 5601
#server.name: "siem-mon-opensearch"
server.name: "opensearch-singleone"

# kibanaserver 的密码也需要在 internal_users.yml 中配置
opensearch.username: "kibanaserver"
opensearch.password: "**********"

server.ssl.enabled: true
server.ssl.certificate: /etc/opensearch-dashboards/dashboard.pem
server.ssl.key: /etc/opensearch-dashboards/dashboard-key.pem

# OpenSearch 连接配置
opensearch.hosts: [ "https://localhost:9200" ]
opensearch.ssl.certificate: /etc/opensearch-dashboards/client-san.pem
opensearch.ssl.key: /etc/opensearch-dashboards/client-san-key.pem
opensearch.ssl.certificateAuthorities: [ "/etc/opensearch-dashboards/root-ca.pem" ]
opensearch.ssl.verificationMode: full
opensearch.requestHeadersWhitelist: [ authorization ]

# Use this setting if you are running opensearch-dashboards without https
opensearch_security.cookie.secure: true
# Set the value to true to disable the welcome screen
home.disableWelcomeScreen: true
# 推荐开启 Workspaces 模式
workspace.enabled: true
opensearch_security.multitenancy.enabled: false
# 开启数据源管理 (如果你的集群涉及跨集群查询)
data_source.enabled: true
explore.enabled: true
explore.discoverMetrics.enabled: true
# 防止大查询导致的内存溢出
opensearch.memoryCircuitBreaker.enabled: true
opensearch.memoryCircuitBreaker.maxPercentage: 0.9
# 请求超时设置 (对于大数据量查询，适当调大，默认 30s 可能不够)
opensearch.requestTimeout: 60000
# 开启压缩请求，减少网络 IO
opensearch.requestCompression: true
# Set the value to true to enable Ui Metric Collectors in Usage Collector
# This publishes the Application Usage and UI Metrics into the saved object, which can be accessed by /api/stats?extended=true&legacy=true&exclude_usage=false
usageCollection.uiMetric.enabled: true

# 重新加载 systemd 配置（如修改过服务文件）
sudo systemctl daemon-reload

# 启用服务（开机自启动）
sudo systemctl enable opensearch opensearch-dashboards

# 确认 OpenSearch 服务正在运行
sudo systemctl status opensearch

# 启动 OpenSearch Dashboards 服务
sudo systemctl start opensearch-dashboards

# 检查 Dashboards 服务状态
sudo systemctl status opensearch-dashboards

# 查看 Dashboards 启动日志
sudo journalctl -u opensearch-dashboards -n 50 --no-pager

# 检查所有相关服务状态
sudo systemctl status opensearch
sudo systemctl status opensearch-dashboards

# 确认端口监听状态
ss -tlnp | grep -E '9200|9300|5601'

# 预期输出：
# LISTEN  0  4096  0.0.0.0:9200  0.0.0.0:*  users:(("java",pid=XXX,fd=XXX))
# LISTEN  0  4096  0.0.0.0:9300  0.0.0.0:*  users:(("java",pid=XXX,fd=XXX))
# LISTEN  0  4096  0.0.0.0:5601  0.0.0.0:*  users:(("node",pid=XXX,fd=XXX))

# 查看 OpenSearch 日志
sudo tail -f /var/log/opensearch/opensearch-singleone.log

# 查看 Dashboards 日志
sudo journalctl -u opensearch-dashboards -f

# 查看所有 systemd 服务日志
sudo journalctl -u opensearch -u opensearch-dashboards -f

# 验证 OpenSearch API（使用 admin 证书）
curl --cacert /etc/opensearch/root-ca.pem \
  --cert /etc/opensearch/admin.pem \
  --key /etc/opensearch/admin-key.pem \
  https://localhost:9200/

# 预期输出包含集群信息：
# {
#   "name" : "opensearch-singleone",
#   "cluster_name" : "opensearch-singleone",
#   "cluster_uuid" : "xxxxx",
#   "version" : {
#     "number" : "3.7.0",
#     ...
#   },
#   "tagline" : "You Know, for Search"
# }

# 验证 OpenSearch 健康状态
curl --cacert /etc/opensearch/root-ca.pem \
  --cert /etc/opensearch/admin.pem \
  --key /etc/opensearch/admin-key.pem \
  -u "admin:Admin@123!Secure" \
  https://localhost:9200/_cluster/health?pretty

# 预期输出：
# {
#   "cluster_name" : "opensearch-singleone",
#   "status" : "green",
#   "number_of_nodes" : 1,
#   ...
# }