Elasticsearch启用Xpack安全后能否禁用？集群启动配置错误求助

云上老周

2026-7-12

问题背景

我运行着由3台独立VM组成的Elasticsearch 8.9集群，搭配Kibana实例，均部署在CentOS 7.9系统上。因无法将应用连接至集群，决定禁用Xpack及SSL安全功能，修改其中一个节点的elasticsearch.yml配置如下：

cluster.name: application
node.name: node_1
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
network.host: 192.168.100.74
http.port: 9200
cluster.initial_master_nodes: ["elastic_master"]
http.host: 0.0.0.0

尝试重启节点时失败，日志报错如下：

[2023-08-27T05:44:51,048][ERROR][o.e.b.Elasticsearch      ] [node_1] fatal exception while booting Elasticsearch
org.elasticsearch.ElasticsearchSecurityException: invalid configuration for xpack.security.transport.ssl - [xpack.security.transport.ssl.enabled] is not set, but the following settings have been configured in elasticsearch.yml : [xpack.security.transport.ssl.keystore.secure_password,xpack.security.transport.ssl.truststore.secure_password]
        at org.elasticsearch.xpack.core.ssl.SSLService.validateServerConfiguration(SSLService.java:650) ~[?:?]
        at org.elasticsearch.xpack.core.ssl.SSLService.loadSslConfigurations(SSLService.java:624) ~[?:?]
        at org.elasticsearch.xpack.core.ssl.SSLService.<init>(SSLService.java:159) ~[?:?]
        at org.elasticsearch.xpack.core.XPackPlugin.createSSLService(XPackPlugin.java:495) ~[?:?]
        at org.elasticsearch.xpack.core.XPackPlugin.createComponents(XPackPlugin.java:324) ~[?:?]
        at org.elasticsearch.node.Node.lambda$new$16(Node.java:733) ~[elasticsearch-8.9.0.jar:?]
        at org.elasticsearch.plugins.PluginsService.lambda$flatMap$1(PluginsService.java:261) ~[elasticsearch-8.9.0.jar:?]
        at java.util.stream.ReferencePipeline$7$1.accept(ReferencePipeline.java:273) ~[?:?]
        at java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:197) ~[?:?]
        at java.util.AbstractList$RandomAccessSpliterator.forEachRemaining(AbstractList.java:722) ~[?:?]
        at java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:509) ~[?:?]
        at java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:499) ~[?:?]
        at java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:575) ~[?:?]
        at java.util.stream.AbstractPipeline.evaluateToArrayNode(AbstractPipeline.java:260) ~[?:?]
        at java.util.stream.ReferencePipeline.toArray(ReferencePipeline.java:616) ~[?:?]
        at java.util.stream.ReferencePipeline.toArray(ReferencePipeline.java:622) ~[?:?]
        at java.util.stream.ReferencePipeline.toList(ReferencePipeline.java:627) ~[?:?]
        at org.elasticsearch.node.Node.<init>(Node.java:748) ~[elasticsearch-8.9.0.jar:?]
        at org.elasticsearch.node.Node.<init>(Node.java:334) ~[elasticsearch-8.9.0.jar:?]
        at org.elasticsearch.bootstrap.Elasticsearch$2.<init>(Elasticsearch.java:234) ~[elasticsearch-8.9.0.jar:?]
        at org.elasticsearch.bootstrap.Elasticsearch.initPhase3(Elasticsearch.java:234) ~[elasticsearch-8.9.0.jar:?]
        at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:72) ~[elasticsearch-8.9.0.jar:?]

已尝试执行unset ES_JAVA_OPTS、停止所有其他节点及Kibana、检查Elastic相关环境变量，但每次执行systemctl start elasticsearch仍出现相同错误。请问是否无需重建集群即可禁用Xpack安全和SSL？

解决方案

可以无需重建集群完成禁用操作，问题核心是残留的SSL配置项未清除，同时需要明确关闭Xpack相关安全模块。具体步骤如下：

清理所有节点的残留SSL配置
错误日志明确指出存在未清理的SSL密钥库配置项，需在所有节点的elasticsearch.yml中删除以下内容（如果存在）：

xpack.security.transport.ssl.keystore.secure_password
xpack.security.transport.ssl.truststore.secure_password
# 同时检查并删除其他关联SSL配置
xpack.security.transport.ssl.keystore.path
xpack.security.transport.ssl.truststore.path

添加明确禁用Xpack及SSL的配置
在所有节点的elasticsearch.yml中添加以下配置，确保完全关闭相关模块：

# 禁用Xpack安全功能
xpack.security.enabled: false
# 禁用传输层SSL
xpack.security.transport.ssl.enabled: false
# 禁用HTTP层SSL（若之前启用过）
xpack.security.http.ssl.enabled: false

统一集群初始化配置
当前cluster.initial_master_nodes配置为["elastic_master"]，但节点名称是node_1，需确保：
- 所有节点的cluster.initial_master_nodes配置一致，且包含集群中所有候选主节点的名称
- 已有集群可注释该配置，但需保证所有节点配置统一
按顺序重启集群
1. 停止所有Elasticsearch节点：systemctl stop elasticsearch
2. 先启动所有候选主节点，等待集群状态变为绿色
3. 再启动其他数据节点
4. 最后启动Kibana，同时修改kibana.yml：添加elasticsearch.ssl.verificationMode: none、xpack.security.enabled: false
验证配置生效
节点启动后，执行命令检查安全状态：
```
curl -XGET http://192.168.100.74:9200/_xpack/security/enabled?pretty
```
返回{"enabled":false}即为禁用成功。

内容的提问来源于stack exchange，提问作者notmeagain