Elasticsearch 6.4.2 X-Pack破解及安装教程
Elastic宣布xpack开源,自6.3版本起,所有的es产品直接集成xpack,无需单独安装,但是依然需要不同级别的license来激活不同的功能
[TOC]
安装X-Pack
正常安装elasticsearch的6.2以上(不包含6.2)版本,安装完成后直接已经集成xpack所有功能,无需单独安装xpack,本文中以通过elastic官方apt源直接安装6.4.2版本为例
破解X-Pack
提取源码
在官网下载elasticsearch-6.4.2的linux版tar.gz包并解压到工作目录
https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.4.2.tar.gz
在以下位置找到要操作的jar包
./elasticsearch/modules/x-pack-core/x-pack-core-6.4.2.jar
使用luyten工具对jar包进行反编译
luyten的git项目地址为: https://github.com/deathmarine/Luyten
打开jar包后找到两个class文件，分别为
org.elasticsearch.license.LicenseVerifier.class
org.elasticsearch.xpack.core.XPackBuild.class
创建工作目录,如/tmp/crack-xpack
将反编译后的java代码保存到工作目录中,创建同名.java文件
LicenseVerifier.java
XPackBuild.java
修改代码
LicenseVerifier.java中有两个静态方法，这就是验证授权文件是否有效的方法，我们把它修改为全部返回true 此外还需要删除一行依赖import org.elasticsearch.common.bytes.*;
package org.elasticsearch.license;
import java.nio.*;
import java.security.*;
import java.util.*;
import org.elasticsearch.common.xcontent.*;
import org.apache.lucene.util.*;
import org.elasticsearch.core.internal.io.*;
import java.io.*;
public class LicenseVerifier
{
public static boolean verifyLicense(final License license, final byte[] publicKeyData) {
return true;
}
public static boolean verifyLicense(final License license) {
return true;
}
}
XPackBuild.java中最后一个静态代码块中的try部分全部删除，这部分会验证jar包是否被修改
package org.elasticsearch.xpack.core;
import org.elasticsearch.common.io.*;
import java.net.*;
import org.elasticsearch.common.*;
import java.nio.file.*;
import java.io.*;
import java.util.jar.*;
public class XPackBuild
{
public static final XPackBuild CURRENT;
private String shortHash;
private String date;
@SuppressForbidden(reason = "looks up path of xpack.jar directly")
static Path getElasticsearchCodebase() {
final URL url = XPackBuild.class.getProtectionDomain().getCodeSource().getLocation();
try {
return PathUtils.get(url.toURI());
}
catch (URISyntaxException bogus) {
throw new RuntimeException(bogus);
}
}
XPackBuild(final String shortHash, final String date) {
this.shortHash = shortHash;
this.date = date;
}
public String shortHash() {
return this.shortHash;
}
public String date() {
return this.date;
}
static {
final Path path = getElasticsearchCodebase();
String shortHash = null;
String date = null;
Label_0157: {
shortHash = "Unknown";
date = "Unknown";
}
CURRENT = new XPackBuild(shortHash, date);
}
}
编译
编译需要引入elasticsearch-6.4.2中lib目录下的jar包以及x-pack-core-6.4.2.jar本身
操作完成后执行以下命令进行将.java文件编译为.class文件
javac -cp ".:/tmp/crack-xpack/elasticsearch-6.4.2/lib/elasticsearch-6.4.2.jar:/tmp/crack-xpack/elasticsearch-6.4.2/lib/lucene-core-7.4.0.jar:/tmp/crack-xpack/elasticsearch-6.4.2/lib/elasticsearch-core-6.4.2.jar:/tmp/crack-xpack/elasticsearch-6.4.2/lib/elasticsearch-cli-6.4.2.jar:/tmp/crack-xpack/elasticsearch-6.4.2/modules/x-pack-core/x-pack-core-6.4.2.jar:/tmp/crack-xpack/elasticsearch-6.4.2/lib/elasticsearch-x-content-6.4.2.jar" LicenseVerifier.java XPackBuild.java
or #如果使用yum安装使用如下命令
javac -cp ".:/usr/share/elasticsearch/lib/elasticsearch-6.5.1.jar:/usr/share/elasticsearch/lib/lucene-core-7.5.0.jar:/usr/share/elasticsearch/lib/elasticsearch-core-6.5.1.jar:/usr/share/elasticsearch/lib/elasticsearch-cli-6.5.1.jar:/usr/share/elasticsearch/modules/x-pack-core/x-pack-core-6.5.1.jar:/usr/share/elasticsearch/lib/elasticsearch-x-content-6.5.1.jar" LicenseVerifier.java XPackBuild.java
编译完成后,将得到的.class文件打包回x-pack-core-6.4.2.jar中
mkdir -p org/elasticsearch/license/
cp LicenseVerifier.class org/elasticsearch/license/
mkdir -p org/elasticsearch/xpack/core/
cp XPackBuild.class org/elasticsearch/xpack/core/
# cp /usr/share/elasticsearch/modules/x-pack-core/x-pack-core-6.5.1.jar .
jar uvf elasticsearch-6.4.2/modules/x-pack-core/x-pack-core-6.4.2.jar org/elasticsearch/license/LicenseVerifier.class org/elasticsearch/xpack/core/XPackBuild.class
执行完毕后,elasticsearch-6.4.2/modules/x-pack-core/x-pack-core-6.4.2.jar即为破解的新包,此时可以再次使用luyten工具进行检查
安装
将破解好的x-pack-core-6.4.2.jar原路径替换到elasticsearch集群的每个节点中,重启集群中的每个接点上的服务
导入license
首先确认xpack.security功能为关闭状态 检查elasticsearch.yml中是否存在以下配置
xpack.security.enabled: false
将此选项设为false后重启集群既可关闭xpack.security功能
在任意一台client节点中,创建license.json文件,
{"license":{"uid":"c6570128-85c2-4f72-8d8f-b1425455b9ee","type":"platinum","issue_date_in_millis":1515369600000,"expiry_date_in_millis":2524579200999,"max_nodes":10000,"issued_to":"elastic","issuer":"elastic","signature":"AAAAAwAAAA07qIy5rp9i1qa5VS3vAAABmC9ZN0hjZDBGYnVyRXpCOW5Bb3FjZDAxOWpSbTVoMVZwUzRxVk1PSmkxaktJRVl5MUYvUWh3bHZVUTllbXNPbzBUemtnbWpBbmlWRmRZb25KNFlBR2x0TXc2K2p1Y1VtMG1UQU9TRGZVSGRwaEJGUjE3bXd3LzRqZ05iLzRteWFNekdxRGpIYlFwYkJiNUs0U1hTVlJKNVlXekMrSlVUdFIvV0FNeWdOYnlESDc3MWhlY3hSQmdKSjJ2ZTcvYlBFOHhPQlV3ZHdDQ0tHcG5uOElCaDJ4K1hob29xSG85N0kvTWV3THhlQk9NL01VMFRjNDZpZEVXeUtUMXIyMlIveFpJUkk2WUdveEZaME9XWitGUi9WNTZVQW1FMG1DenhZU0ZmeXlZakVEMjZFT2NvOWxpZGlqVmlHNC8rWVVUYzMwRGVySHpIdURzKzFiRDl4TmM1TUp2VTBOUlJZUlAyV0ZVL2kvVk10L0NsbXNFYVZwT3NSU082dFNNa2prQ0ZsclZ4NTltbU1CVE5lR09Bck93V2J1Y3c9PQAAAQBXa2fLJmNxlfTsXWcKjk1Z7JdZF3wQmJwOTgVR306TV8IwvielPKIrF99El/ie0oaJqbMzH6Khz+aR4ugNc21j+AxK9PTJ6PupE4VYb4auHFGmwHJ9cst96xD4wH77XlSGkTKhm31ZwCQvL/j3+Qjr+PtGOPeiZM5F99AuLLNmYhHZLFHO+fI5feBWwppCVjFvygJf5jMsvbJQQwsGxjX26+PUy12+0eHD1wJWDfrTgaIQ//AaVxvv+bkwBWxgCvJcC7PLrHKdNgkuggU2+G2EXLqJX6stJAoH8R1NA0JAA5yDzdB8M4+shlgDckbcAdUsV6rjUlQwzjbsK/BPHY9A","start_date_in_millis":1515369600000}}
执行以下命令导入lisense
curl -XPUT -u elastic 'http://127.0.0.1:9200/_xpack/license' -H "Content-Type: application/json" -d @license.json
如果返回vaild,破解完成