Elasticsearch 8.15与Kibana 8.15认证失败问题求助

问题现象 #

• 安装Elasticsearch 8.15和Kibana 8.15后，使用elastic用户登录Kibana UI无法执行任何操作
• Elasticsearch集群状态为绿色
• 打开Kibana UI时，ES日志出现1次认证失败记录；使用elastic登录时，出现2次该记录

Elasticsearch日志 #

[INFO ][o.e.x.s.a.RealmsAuthenticator] [elasticsearch-01] Authentication of [kibana] was terminated by realm [reserved] - failed to authenticate user [kibana]
[INFO ][o.e.x.s.a.RealmsAuthenticator] [elasticsearch-01] Authentication of [kibana] was terminated by realm [reserved] - failed to authenticate user [kibana]
[INFO ][o.e.x.s.a.RealmsAuthenticator] [elasticsearch-01] Authentication of [kibana] was terminated by realm [reserved] - failed to authenticate user [kibana]

Kibana日志 #

{"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"8.11.0"},"@timestamp":"2024-09-06T19:33:45.418+03:00","message":"Authentication attempt failed: {\"error\":{\"root_cause\":[{\"type\":\"security_exception\",\"reason\":\"unable to authenticate user [kibana] for REST request [/_security/_authenticate]\",\"header\":{\"WWW-Authenticate\":[\"Basic realm=\\\"security\\\", charset=\\\"UTF-8\\\"\",\"Bearer realm=\\\"security\\\"\",\"ApiKey\"]}}],\"type\":\"security_exception\",\"reason\":\"unable to authenticate user [kibana] for REST request [/_security/_authenticate]\",\"header\":{\"WWW-Authenticate\":[\"Basic realm=\\\"security\\\", charset=\\\"UTF-8\\\"\",\"Bearer realm=\\\"security\\\"\",\"ApiKey\"]}},\"status\":401}","log":{"level":"ERROR","logger":"plugins.security.authentication"},"process":{"pid":13961,"uptime":97.666693813},"trace":{"id":"cdc268f732c41d11315652b5882ac158"},"transaction":{"id":"bba4ea098195a6fe"}}

Elasticsearch配置 #

cluster.name: test-elastic
node.name: elasticsearch-01
network.host: 0.0.0.0
discovery.seed_hosts: [10.10.5.25, 10.10.5.26, 10.10.5.27]
http.port: 9200
cluster.initial_master_nodes: ["10.10.5.25"]
path.data: "/data/elasticsearch"
path.logs: "/var/log/elasticsearch"
xpack.security.enabled: true
xpack.security.http.ssl:
  enabled: true
  keystore.path: certs/http.p12
xpack.security.transport.ssl:
  enabled: true
  verification_mode: certificate
  client_authentication: required
  keystore.path: certs/elastic-certificates.p12

Kibana配置 #

server.port: 5601
server.host: "0.0.0.0"
server.name: "kibana-01"
#xpack.security.enabled: false
elasticsearch.hosts: ["https://10.10.5.25:9200", "https://10.10.5.26:9200", "https://10.10.5.27:9200",]
#elasticsearch.username: "kibana_system"
#elasticsearch.password: "some_password"
elasticsearch.serviceAccountToken: "some_token"
elasticsearch.ssl.verificationMode: certificate
elasticsearch.ssl.certificateAuthorities: [ "/etc/kibana/elasticsearch-ca.pem" ]
server.ssl.enabled: true
server.ssl.certificate: /etc/kibana/kibana-server.crt
server.ssl.key: /etc/kibana/kibana-server.key

logging:
  appenders:
    file:
      type: file
      fileName: /var/log/kibana/kibana.log
      layout:
        type: json
  root:
    appenders:
      - default
      - file

已尝试的操作 #

• 分别使用kibana_system账号密码和服务账号令牌两种方式配置Kibana，均出现相同的认证错误

内容的提问来源于stack exchange，提问作者napoleon