nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Elasticsearch SSL

Jonas Andersson

I am setting up a Bitbucket datacenter cluster and am having some problems with enabling SSL on elasticsearch. I have installed version 2.3.4 according to elasticsearch's own documents, installed buckler and it authenticates perfectly, but even when SSL is enabled it does not start up.

buckler.yml:

auth.basic.http.enabled: true
auth.basic.username: admin
auth.basic.password: &lt;ourpasswordhere&gt;
auth.basic.tcp.enabled: true
tls.http.enabled: true
tls.tcp.enabled: true
tls.keystore.path: /opt/elasticsearch-2.3.4/cacerts
tls.keystore.password: changeit

At this point i keep getting errors like:

[2017-01-18 17:24:25,754][WARN ][netty.channel.socket.nio.AbstractNioSelector] Failed to initialize an accepted socket.
java.security.AccessControlException: access denied ("java.io.FilePermission" "/opt/elasticsearch-2.3.4/cacerts" "read")
    at java.security.AccessControlContext.checkPermission(AccessControlContext.java:472)
    at java.security.AccessController.checkPermission(AccessController.java:884)
    at java.lang.SecurityManager.checkPermission(SecurityManager.java:549)
    at java.lang.SecurityManager.checkRead(SecurityManager.java:888)
    at java.io.FileInputStream.&lt;init&gt;(FileInputStream.java:127)
    at java.io.FileInputStream.&lt;init&gt;(FileInputStream.java:93)
    at com.atlassian.elasticsearch.buckler.config.TlsConfig.createContext(TlsConfig.java:63)
    at com.atlassian.elasticsearch.buckler.config.TlsConfig.createHandler(TlsConfig.java:49)
    at com.atlassian.elasticsearch.buckler.SecureHttpServerTransport$TlsHttpChannelPipelineFactory.getPipeline(SecureHttpServerTransport.java:99)
    at org.jboss.netty.channel.socket.nio.NioServerBoss.registerAcceptedChannel(NioServerBoss.java:134)
    at org.jboss.netty.channel.socket.nio.NioServerBoss.process(NioServerBoss.java:104)
    at org.jboss.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:337)
    at org.jboss.netty.channel.socket.nio.NioServerBoss.run(NioServerBoss.java:42)
    at org.jboss.netty.util.ThreadRenamingRunnable.run(ThreadRenamingRunnable.java:108)
    at org.jboss.netty.util.internal.DeadLockProofWorker$1.run(DeadLockProofWorker.java:42)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
    at java.lang.Thread.run(Thread.java:745)

Yet, the user i created for elasticsearch CAN read the file (can cat it, can append to it..), so pretty sure this is a false error.

I also never see a SSL port exposed. Will it be on 9300? Any help would be appreciated.

Accepted answers

Jonas Andersson

Damn this crap is badly documented. The CACERTS needs to be inside of the config directory, nowhere else.

All comments

Jonas Andersson

Damn this crap is badly documented. The CACERTS needs to be inside of the config directory, nowhere else.

Carl Golaszewski

Agree on the documentation. On the cacerts - The cacerts is typically the truststore, not the keystore. I don't think the cacerts needs to be in the config dir.

Gustavo Segura

Jonas,

Did you followed another guide other than this? https://confluence.atlassian.com/bitbucketserver/install-and-configure-a-remote-elasticsearch-instance-815577748.html

I have seen other guides using the Shield plugin...did you only used Buckler?

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

bitbucket

bitbucket-server

data-center

elastic-search