Open Distro for Elasticsearch(Windows)

Open Distro for Elasticsearch provides a powerful, easy-to-use event monitoring, security, and alerting system, enabling you to monitor your data and send notifications automatically to your stakeholders. With an intuitive Kibana interface and powerful API, it is easy to set up and manage alerts.
Available Plugins in Open Distro for Elasticsearch :

• Security
• Job Scheduler
• Alerting
• SQL 
• Reports Scheduler
• Index State Management
• KNN
• Anomaly Detection
• Performance Analyzer                          

  Elasticsearch version	Plugin versions
  7.10.0	opendistro-anomaly-detection    1.12.0.0 opendistro-job-scheduler        1.12.0.0 opendistro-knn                  1.12.0.0  opendistro_alerting             1.12.0.2  opendistro_index_management     1.12.0.1  opendistro_performance_analyzer 1.12.0.0  opendistro_security             1.12.0.0  opendistro_sql                  1.12.0.0  opendistro-reports-scheduler    1.12.0.0
  7.9.1	opendistro-anomaly-detection    1.10.1.0, 1.11.0.0 opendistro-job-scheduler        1.10.1.0, 1.11.0.0 opendistro-knn                  1.10.1.0, 1.11.0.0  opendistro_alerting             1.10.1.2, 1.11.0.1  opendistro_index_management     1.10.1.1, 1.11.0.0  opendistro_performance_analyzer 1.10.1.0, 1.11.0.0  opendistro_security             1.10.1.0, 1.11.0.0  opendistro_sql                  1.10.1.1, 1.11.0.0
  7.8.0	opendistro-anomaly-detection    1.9.0.0 opendistro-job-scheduler        1.9.0.0  opendistro-knn                  1.9.0.0  opendistro_alerting             1.9.0.0  opendistro_index_management     1.9.0.0  opendistro_performance_analyzer 1.9.0.1  opendistro_security             1.9.0.0  opendistro_sql                  1.9.0.0
  7.7.0	opendistro-anomaly-detection    1.8.0.0  opendistro-job-scheduler        1.8.0.0  opendistro-knn                  1.8.0.0  opendistro_alerting             1.8.0.0  opendistro_index_management     1.8.0.0  opendistro_performance_analyzer 1.8.0.0  opendistro_security             1.8.0.0  opendistro_sql                  1.8.0.0
  7.6.1	opendistro-anomaly-detection    1.7.0.0  opendistro-job-scheduler        1.7.0.0  opendistro-knn                  1.7.0.0  opendistro_alerting             1.7.0.0  opendistro_index_management     1.7.0.0  opendistro_performance_analyzer 1.7.0.0  opendistro_security             1.7.0.0  opendistro_sql                  1.7.0.0
  7.4.2	opendistro-job-scheduler        1.4.0.0  opendistro-knn                  1.4.0.0  opendistro_alerting             1.4.0.0  opendistro_index_management     1.4.0.0 opendistro_performance_analyzer 1.4.0.0  opendistro_security             1.4.0.0  opendistro_sql                  1.4.0.0
  7.3.2	opendistro-job-scheduler        1.3.0.0 opendistro_alerting             1.3.0.1  opendistro_index_management     1.3.0.1  opendistro_performance_analyzer 1.3.0.0  opendistro_security             1.3.0.0  opendistro_sql                  1.3.0.0
  7.2.1	opendistro-job-scheduler        1.2.1 opendistro_alerting             1.2.1.0  opendistro_performance_analyzer 1.2.1.0  opendistro_security             1.2.1.0  opendistro_sql                  1.2.1.0
  7.2.0	opendistro-job-scheduler        1.2.0  opendistro_alerting             1.2.0.0  opendistro_performance_analyzer 1.2.0.0  opendistro_security             1.2.0.0  opendistro_sql                  1.2.0.0
  7.1.1	opendistro-job-scheduler        1.1.0  opendistro_alerting             1.1.0.0  opendistro_performance_analyzer 1.1.0.0  opendistro_security             1.1.0.0  opendistro_sql                  1.1.0.0
  7.0.1	opendistro-job-scheduler        1.0.0 opendistro_alerting             1.0.0.0  opendistro_performance_analyzer 1.0.0.0  opendistro_security             1.0.0.2  opendistro_sql                  1.0.0.0
  6.8.1	opendistro_alerting             0.10.0.0 opendistro_performance_analyzer 0.10.0.0  opendistro_security             0.10.0.0  opendistro_sql                  0.10.0.0
  6.7.1	opendistro_alerting             0.9.0.0 opendistro_performance_analyzer 0.9.0.0  opendistro_security             0.9.0.0  opendistro_sql                  0.9.0.0
  6.6.2	opendistro_alerting             0.8.0.0 opendistro_performance_analyzer 0.8.0.0  opendistro_security             0.8.0.0  opendistro_sql                  0.8.0.0
  6.5.4	opendistro_alerting             0.7.0.0 opendistro_performance_analyzer 0.7.0.0 opendistro_security             0.7.0.1 opendistro_sql                  0.7.0.0

Note: In this article, we'll only focus on the security Plugin for the Windows Platform.

Prerequisites :

• Elasticsearch(To install plugins manually, you must have the exact OSS version of Elasticsearch installed (for example, 6.6.2 and not 6.6.1).

Step 1:
Navigate to the Elasticsearch directory (most likely, it is elasticsearch/bin), and run the install command for each plugin.

Step 2:

 Install certificates, to do this navigate to  (most likely, it is elasticsearch/plugins/opendistrosecurity/tools), and run the shell script(install_demo_configuration.sh)

Step 3:
Since we are trying to integrate an open-source plugin that is not developed by ELK, we need to turn off the native x-pack security. To do so navigate to the config directory and open elasticsearch.yml (most likely, it is elasticsearch/config/elasticsearch.yml).Then add the following line in that file.

Step 4:
Start Elasticsearch and try to hit https://localhost:9200 , you will get a response like this

It means , open distro security plugin is installed and is not initialized to do authentication and authorization. To initialize it you have run the securityadmin.bat with required arguments

NOTE: The path provided here for cert files will work if you haven't moved your cert files to some other directory, you can always refer to the directory where your cert files are stored.

The followings are the arguments that you might need for advanced configurations.

Step 5:
Now try to access https://localhost:9200, if you get a prompt asking for username and password. Hurrrrayyy🎊🎉!!  we have implemented the basic auth using open distro.

The default username will be admin  and password is admin. 

• What if you don't need basic authentication….Surprise 🎊🎉 we can implement token based authentication using  Open Distro.

To implement token based authentication follow this steps:

• Navigate to elasticsearch/plugins/opendistrosecurity/securityconfig and open config.yml  make the changes as below.

Note: If you only need token based authentication and not basic authentication , then make http_enabled and  transport_enabled  to false in basic_internal_auth_domain  section.

• Once you are done with the changes save the file and run the securityadmin.bat (specified in step 4).
• If you got this message “Done with success” .Then we can test our implementation.
• Open https://jwt.io/. Then create a token with following payload.

    change the exp  value in payload accordingly.

• Make sure you have added the signing key as well like in the above picture
• copy the token and try hitting elasticsearch in postman with Bearer token (copied jwt token).

Likewise, we can also enable proxy-based authentication.
Here is the reference link for detailed information about each plugin Open Distro.