curl -sS -k -u elastic https://127.0.0.1:9200/
{
"name" : "es-node-1",
"cluster_name" : "demo-es",
"cluster_uuid" : "uX1d**************",
"version" : {
"number" : "8.14.3",
"build_flavor" : "default",
"build_type" : "rpm",
"lucene_version" : "9.11.1",
"minimum_wire_compatibility_version" : "7.17.0"
},
"tagline" : "You Know, for Search"
}
curl -sS -k -u elastic https://127.0.0.1:9200/_cluster/health?pretty（节选）
{
"cluster_name" : "demo-es",
"status" : "green",
"number_of_nodes" : 3,
"number_of_data_nodes" : 3
}
curl -sS -k -u elastic https://127.0.0.1:9200/_cat/nodes?v
ip heap.percent ram.percent cpu node.role master name
192.168.10.5 62 78 6 cdfhilmrstw * es-node-1
192.168.10.6 55 77 4 cdfhilmrstw - es-node-2
192.168.10.7 58 76 5 cdfhilmrstw - es-node-3
curl -sS -k -u elastic https://127.0.0.1:9200/_license?pretty（节选）
{
"license" : {
"status" : "active",
"type" : "basic",
"issue_date" : "2026-01-15T00:00:00.000Z"
}
}
grep -n "xpack.security.enabled" /etc/elasticsearch/elasticsearch.yml
xpack.security.enabled: true（8.x 自动配置写入；7.x 正确整改后亦应显式为 true）
curl -sS -k https://127.0.0.1:9200/ -o /dev/null -w "https无凭证:%{http_code}\n"
https无凭证:401
（无凭证请求被拒绝，安全特性生效；若回显 200 并输出集群信息，即为 7.x 默认关闭形态，判不符合/高风险）
curl -sS -k -u elastic https://127.0.0.1:9200/_security/user/elastic?pretty
{
"elastic" : {
"username" : "elastic",
"roles" : [ "superuser" ],
"enabled" : true
}
}
curl -sS -k -u elastic:deliberately-wrong https://127.0.0.1:9200/ -o /dev/null -w "%{http_code}\n"
401
（超管口令由 8.x 首启自动生成并于交付时重置，按季度轮换；错误口令被拒）
curl -sS -k -u elastic https://127.0.0.1:9200/_security/user?pretty（节选）
{
"elastic" : { "roles" : [ "superuser" ], "enabled" : true },
"demo-user" : { "roles" : [ "demo-readonly" ], "enabled" : true },
"kibana_system" : { "roles" : [ "kibana_system" ], "enabled" : true }
}
grep -n -A4 "xpack.security.authc.realms" /etc/elasticsearch/elasticsearch.yml
xpack.security.authc.realms.native.native1:
order: 0
（业务账户走 native realm 并按角色最小授权；未启用匿名访问）
grep -n "xpack.security.authc.anonymous" /etc/elasticsearch/elasticsearch.yml
（无输出：未配置匿名访问）
curl -sS -k -u elastic https://127.0.0.1:9200/_security/api_key?pretty（节选）
{
"api_keys" : [
{ "id" : "a1b2********", "name" : "logbeat-writer", "invalidated" : false },
{ "id" : "c3d4********", "name" : "old-report-key", "invalidated" : true }
]
}
（API Key 按应用命名发放，废弃 Key 已标记 invalidated）
curl -sS -k -u elastic https://127.0.0.1:9200/_security/role?pretty（节选）
{
"demo-readonly" : {
"cluster" : [ "monitor" ],
"indices" : [ {
"names" : [ "app-log-*" ],
"privileges" : [ "read" ],
"field_security" : { "grants" : [ "@timestamp", "message", "src_ip" ] },
"query" : "{\"term\":{\"env\":\"prod\"}}"
} ]
}
}
（只读角色限定 app-log-* 索引 read 权限并启用字段级安全，未授予 write/manage）
curl -sS -k -u elastic https://127.0.0.1:9200/_security/user?pretty | grep -B3 superuser
"elastic" : { "roles" : [ "superuser" ], "enabled" : true },
"es-admin" : { "roles" : [ "superuser" ], "enabled" : true },
（superuser 仅绑定 2 个运维账户，业务账户均使用 demo-readonly 等受限角色）
curl -sS -k -u elastic https://127.0.0.1:9200/_security/service?pretty（节选）
{ "elastic/fleet-server": { "role_descriptor": { "cluster": [ "monitor", ... ] } } }
grep -n -E "network.host|http.host" /etc/elasticsearch/elasticsearch.yml
network.host: 192.168.10.5
ss -lntp | grep 9200
LISTEN 0 1024 *:9200 users:(("java",pid=2311,fd=312))
（监听由 network.host 决定；防火墙仅对应用网段 192.168.30.0/24 放行 9200/tcp）
curl -sS -k -u elastic https://127.0.0.1:9200/_license?pretty | grep -E "\"type\"|\"status\""
"type" : "basic",
"status" : "active"
（Basic 许可：具备 TLS+RBAC 基线，DLS/FLS 未启用；以索引级最小授权+防火墙限源补偿，列入升级建议）
grep -n "xpack.security.audit" /etc/elasticsearch/elasticsearch.yml
xpack.security.audit.enabled: true
xpack.security.audit.logfile.events.include: authentication_success,authentication_failed,access_denied,security_config_change
（审计已启用并显式补充 authentication_success；默认列表不含成功登录事件，未显式配置时登录成功不可审计，应记录为整改建议）
ls -l /var/log/elasticsearch/ | grep audit（节选）
-rw-r--r-- 1 elasticsearch elasticsearch 10485760 Sep 01 00:00 demo-es_audit.json
-rw-r--r-- 1 elasticsearch elasticsearch 10485760 Aug 01 00:00 demo-es_audit-2026-08-01.json
-rw-r--r-- 1 elasticsearch elasticsearch 10485760 Jul 01 00:00 demo-es_audit-2026-07-01.json
（审计文件按月滚动，历史文件转储至日志平台集中留存 180 天）
grep -R -i "elasticsearch" /etc/logstash/conf.d（节选）
input { beats { port => 5044 } }
output if [fields][app] == "elasticsearch" { elasticsearch { hosts => ["https://192.168.40.10:9200"] } }
（节点日志经 Filebeat→Logstash 上送日志审计平台，平台留存 180 天，可检索 2026-03 以前记录）
curl -sS -k -u elastic https://127.0.0.1:9200/ | grep -E "number|lucene_version"
"number" : "8.14.3",
"lucene_version" : "9.11.1",
（8.x 维护期内；对照 support/eol 页 8.x 维护期至 2027-01-15）
curl -sS -k -u elastic https://127.0.0.1:9200/_cat/plugins?v
name component version
es-node-1 analysis-icu 8.14.3
es-node-1 repository-s3 8.14.3
（仅官方随版本分发的插件，与节点版本一致）
grep -n -E "script.allowed_types|script.allowed_contexts" /etc/elasticsearch/elasticsearch.yml
（无输出：按官方文档默认允许 inline/stored 两类脚本与全部上下文）
（整改建议：无脚本业务场景时收敛 script.allowed_types: none；如需保留，仅放行实际使用的上下文）
ss -lntp | grep -E "9200|9300"
LISTEN 0 1024 *:9200 users:(("java",pid=2311,fd=312))
LISTEN 0 1024 192.168.10.5:9300 users:(("java",pid=2311,fd=287))
grep -n -E "xpack.security.(http|transport).ssl" /etc/elasticsearch/elasticsearch.yml（节选）
xpack.security.http.ssl.enabled: true
xpack.security.http.ssl.keystore.path: certs/http.p12
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: full
（HTTP 层与传输层均已启用 TLS，transport 证书校验模式为默认 full）
ps -ef | grep [e]lasticsearch
elastic+ 2311 1 2 Aug30 ? 06:12:33 /usr/share/elasticsearch/jdk/bin/java ... org.elasticsearch.bootstrap.Elasticsearch
systemctl list-units --type=service --state=running | grep -i -E "edr|hids"
edr-agent.service loaded active running EDR Agent
（以专用低权账户运行；宿主机部署 EDR，病毒库当日更新）
grep -n "xpack.security.transport.ssl" /etc/elasticsearch/elasticsearch.yml（节选）
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: full
xpack.security.transport.ssl.keystore.path: certs/transport.p12
xpack.security.transport.ssl.truststore.path: certs/transport.p12
curl -sS -k -u elastic https://127.0.0.1:9200/_ssl/certificates?pretty（节选，字段以实际版本为准）
"subject_dn" : "CN=es-node-1",
"expiry" : "2027-08-30T00:00:00.000Z"
（传输层启用 TLS、校验模式 full，证书在有效期内）
curl -sS -k -u elastic https://127.0.0.1:9200/_snapshot?pretty（节选）
{
"demo-repo" : { "type" : "fs", "settings" : { "location" : "/data/snapshots" } }
}
curl -sS -k -u elastic https://127.0.0.1:9200/_cat/snapshots/demo-repo?v
id repository status start_time indices
snapshot-2026.09.01 demo-repo SUCCESS 01:30:02 12
snapshot-2026.08.31 demo-repo SUCCESS 01:30:01 12
（每日 SLM 快照全部 SUCCESS，仓库位于独立数据盘并同步至备份平台）
curl -sS http://127.0.0.1:9200/ -o /dev/null -w "http探测:%{http_code}\n"
http探测:400
（明文请求被拒绝，HTTP 层 TLS 生效；7.x 未启用 TLS 时该探测返回 200，属高风险证据）
openssl s_client -connect 127.0.0.1:9200 -brief </dev/null
Protocol version: TLSv1.3
Ciphersuite: TLS_AES_256_GCM_SHA384
Peer certificate: CN=es-node-1
（协商 TLSv1.3，证书主体与配置一致）
/usr/share/elasticsearch/bin/elasticsearch-keystore list（节选）
keystore.seed
xpack.security.http.ssl.keystore.secure_password
xpack.security.transport.ssl.keystore.secure_password
grep -R -n -i "password" /etc/elasticsearch/elasticsearch.yml
（无输出：配置文件无明文口令，密钥均入 keystore，文件归属 elasticsearch 运行账户）
df -hT /var/lib/elasticsearch
/dev/mapper/vg--data-lv--es xfs 2.0T 688G 1.4T 34% /var/lib/elasticsearch
cryptsetup isLuks /dev/vdb && echo "LUKS encrypted"
LUKS encrypted
（数据目录落于 LUKS 加密卷；密钥由单位密管平台托管，介质报废随制度销毁）
curl -sS -k -u elastic https://127.0.0.1:9200/_slm/policy?pretty（节选）
{
"daily-snapshots" : {
"policy" : {
"schedule" : "0 30 1 * * ?",
"name" : "<daily-snap-{now/d}>",
"repository" : "demo-repo",
"retention" : { "expire_after" : "30d" }
},
"next_execution_millis" : 1780000000000,
"stats" : { "snapping_in_progress" : false }
}
}
（每日 01:30 全量快照，保留 30 天，仓库另由备份平台异地拷贝）
find /etc/elasticsearch -type f
/etc/elasticsearch/elasticsearch.yml
/etc/elasticsearch/jvm.options
/etc/elasticsearch/users
/etc/elasticsearch/users_roles
/etc/elasticsearch/certs/http.p12
/etc/elasticsearch/certs/transport.p12
/etc/elasticsearch/elasticsearch.keystore
（上述文件纳入每周配置备份，保留 8 个版本，备份介质加密存放）
curl -sS -k -u elastic https://127.0.0.1:9200/_cluster/health?pretty | grep -E "status|number_of_nodes"
"status" : "green",
"number_of_nodes" : 3,
"number_of_data_nodes" : 3,
（3 节点集群，索引副本数 1；2026-08-20 曾在测试环境完成整库快照恢复演练，RTO 2.5 小时，记录在案）
curl -sS -k -u elastic https://127.0.0.1:9200/_ilm/policy?pretty（节选）
{
"demo-log-policy" : {
"policy" : { "phases" : {
"delete" : { "min_age" : "90d", "actions" : { "delete" : { } } }
} }
}
}
（业务日志索引 90 天后由 ILM 自动删除，索引清单中无长期滞留的废弃索引）
curl -sS -k -u elastic https://127.0.0.1:9200/_security/api_key?pretty | grep -E "name|invalidated"（节选）
"name" : "logbeat-writer", "invalidated" : false,
"name" : "old-report-key", "invalidated" : true,
（下线应用的 Key 已于 2026-07 撤销；按默认策略失效 7 天后可清理；台账与回显一致）
curl -sS -k -u elastic https://127.0.0.1:9200/_cat/indices?v（节选）
health status index docs.count store.size
green open app-log-2026.08.31 4.2m 1.1gb
green open user-profile 86k 210mb
green open order-index 1.3m 620mb
（user-profile/order-index 承载个人信息：应用侧写入前对手机号/证件号做掩码，索引访问限 demo-readonly 角色并启用字段级安全）
curl -sS -k -u elastic https://127.0.0.1:9200/_ilm/policy?pretty | grep -E "min_age|\"delete\""
"delete" : { "min_age" : "90d", "actions" : { "delete" : { } } }
（个人信息类索引 90 天自动删除；查询走 demo-readonly 角色且仅开放脱敏后字段；导出申请经安全审批后由运维执行并留痕）