Allow node to enroll to cluster on startup

distribution/src/bin/elasticsearch

@@ -17,15 +17,20 @@ source "`dirname "$0"`"/elasticsearch-env
 
 CHECK_KEYSTORE=true
 DAEMONIZE=false
-for option in "$@"; do
-  case "$option" in
-    -h|--help|-V|--version)
-      CHECK_KEYSTORE=false
-      ;;
-    -d|--daemonize)
-      DAEMONIZE=true
-      ;;
-  esac
+ENROLL_TO_CLUSTER=false
+# Store original arg array as we will be shifting through it below
+ARG_LIST=($@)
+while [ $# -gt 0 ]; do
+   if [[ $1 == "--enrollment-token" ]]; then
+     ENROLL_TO_CLUSTER=true
+     ENROLLMENT_TOKEN="$2"
+     shift
+   elif [[ $1 == "-h" || $1 == "--help" || $1 == "-V" || $1 == "--version" ]]; then
+     CHECK_KEYSTORE=false
+   elif [[ $1 == "-d" || $1 == "--daemonize" ]]; then
+     DAEMONIZE=true
+   fi
+   shift
 done
 
 if [ -z "$ES_TMPDIR" ]; then
@@ -45,6 +50,14 @@ then
   fi
 fi
 
+if [[ $ENROLL_TO_CLUSTER = true ]]; then
+  ES_MAIN_CLASS=org.elasticsearch.xpack.security.cli.EnrollNodeToCluster \
+    ES_ADDITIONAL_SOURCES="x-pack-env;x-pack-security-env" \
+    ES_ADDITIONAL_CLASSPATH_DIRECTORIES=lib/tools/security-cli \
+    "`dirname "$0"`"/elasticsearch-cli \
+    --enrollment-token "$ENROLLMENT_TOKEN" <<<"$KEYSTORE_PASSWORD"
+fi
+
 # The JVM options parser produces the final JVM options to start Elasticsearch.
 # It does this by incorporating JVM options in the following way:
 #   - first, system JVM options are applied (these are hardcoded options in the
@@ -67,7 +80,7 @@ if [[ $DAEMONIZE = false ]]; then
     -Des.bundled_jdk="$ES_BUNDLED_JDK" \
     -cp "$ES_CLASSPATH" \
     org.elasticsearch.bootstrap.Elasticsearch \
-    "$@" <<<"$KEYSTORE_PASSWORD"
+    "${ARG_LIST[@]}" <<<"$KEYSTORE_PASSWORD"
 else
   exec \
     "$JAVA" \
@@ -80,7 +93,7 @@ else
     -Des.bundled_jdk="$ES_BUNDLED_JDK" \
     -cp "$ES_CLASSPATH" \
     org.elasticsearch.bootstrap.Elasticsearch \
-    "$@" \
+    "${ARG_LIST[@]}" \
     <<<"$KEYSTORE_PASSWORD" &
   retval=$?
   pid=$!

distribution/src/bin/elasticsearch.bat

@@ -5,6 +5,7 @@ setlocal enableextensions
 
 SET params='%*'
 SET checkpassword=Y
+SET enrolltocluster=N
 
 :loop
 FOR /F "usebackq tokens=1* delims= " %%A IN (!params!) DO (
@@ -33,6 +34,12 @@ FOR /F "usebackq tokens=1* delims= " %%A IN (!params!) DO (
 		SET checkpassword=N
 	)
 
+	IF "!current!" == "--enrollment-token" (
+        SHIFT
+        SET enrolltocluster=Y
+        SET enrollmenttoken=%~1
+	)
+
 	IF "!silent!" == "Y" (
 		SET nopauseonerror=Y
 	) ELSE (
@@ -68,6 +75,22 @@ IF "%checkpassword%"=="Y" (
   )
 )
 
+rem windows batch pipe will choke on special characters in strings
+SET KEYSTORE_PASSWORD=!KEYSTORE_PASSWORD:^^=^^^^!
+SET KEYSTORE_PASSWORD=!KEYSTORE_PASSWORD:^&=^^^&!
+SET KEYSTORE_PASSWORD=!KEYSTORE_PASSWORD:^|=^^^|!
+SET KEYSTORE_PASSWORD=!KEYSTORE_PASSWORD:^<=^^^<!
+SET KEYSTORE_PASSWORD=!KEYSTORE_PASSWORD:^>=^^^>!
+SET KEYSTORE_PASSWORD=!KEYSTORE_PASSWORD:^\=^^^\!
+
+IF "%enrolltocluster%"=="Y" ()
+  SET ES_MAIN_CLASS=org.elasticsearch.xpack.security.cli.EnrollNodeToCluster
+  SET ES_ADDITIONAL_SOURCES=x-pack-env;x-pack-security-env
+  SET ES_ADDITIONAL_CLASSPATH_DIRECTORIES=lib/tools/security-cli
+  ECHO.!KEYSTORE_PASSWORD!|CALL "%~dp0elasticsearch-cli.bat" --enrollment-token %enrollmenttoken%
+  || GOTO EXIT
+)
+
 if not defined ES_TMPDIR (
   for /f "tokens=* usebackq" %%a in (`CALL %JAVA% -cp "!ES_CLASSPATH!" "org.elasticsearch.tools.launchers.TempDirectory"`) do set  ES_TMPDIR=%%a
 )
@@ -89,14 +112,6 @@ if "%MAYBE_JVM_OPTIONS_PARSER_FAILED%" == "jvm_options_parser_failed" (
   exit /b 1
 )
 
-rem windows batch pipe will choke on special characters in strings
-SET KEYSTORE_PASSWORD=!KEYSTORE_PASSWORD:^^=^^^^!
-SET KEYSTORE_PASSWORD=!KEYSTORE_PASSWORD:^&=^^^&!
-SET KEYSTORE_PASSWORD=!KEYSTORE_PASSWORD:^|=^^^|!
-SET KEYSTORE_PASSWORD=!KEYSTORE_PASSWORD:^<=^^^<!
-SET KEYSTORE_PASSWORD=!KEYSTORE_PASSWORD:^>=^^^>!
-SET KEYSTORE_PASSWORD=!KEYSTORE_PASSWORD:^\=^^^\!
-
 ECHO.!KEYSTORE_PASSWORD!| %JAVA% %ES_JAVA_OPTS% -Delasticsearch ^
   -Des.path.home="%ES_HOME%" -Des.path.conf="%ES_PATH_CONF%" ^
   -Des.distribution.flavor="%ES_DISTRIBUTION_FLAVOR%" ^

x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/ConfigInitialNode.java

@@ -86,6 +86,8 @@ public class ConfigInitialNode extends EnvironmentAwareCommand {
     private static final int HTTP_CERTIFICATE_DAYS = 2 * 365;
     private static final int HTTP_KEY_SIZE = 4096;
     private static final String TLS_CONFIG_DIR_NAME_PREFIX = "tls_auto_config_initial_node_";
+    static final String AUTO_CONFIGURATION_START_MARKER = "---------------------- Security auto configuration start ---------------------";
+    static final String AUTO_CONFIGURATION_END_MARKER = "---------------------- Security auto configuration end ---------------------";
 
     private final OptionSpec<Void> strictOption = parser.accepts("strict", "Error if auto config cannot be performed for any reason");
 
@@ -336,6 +338,7 @@ protected void execute(Terminal terminal, OptionSet options, Environment env) th
                         bw.newLine();
                     }
                     bw.newLine();
+                    bw.write(AUTO_CONFIGURATION_START_MARKER);
                     bw.newLine();
                     bw.write("###################################################################################");
                     bw.newLine();
@@ -404,6 +407,8 @@ protected void execute(Terminal terminal, OptionSet options, Environment env) th
                         bw.write(HttpTransportSettings.SETTING_HTTP_HOST.getKey() + ": [_local_, _site_]");
                         bw.newLine();
                     }
+                    bw.write(AUTO_CONFIGURATION_END_MARKER);
+                    bw.newLine();
                 }
             });
         } catch (Exception e) {

x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/EnrollNodeToCluster.java

@@ -63,6 +63,7 @@
 import java.security.cert.X509Certificate;
 import java.time.ZoneOffset;
 import java.time.ZonedDateTime;
+import java.util.Arrays;
 import java.util.Base64;
 import java.util.HashSet;
 import java.util.List;
@@ -75,6 +76,8 @@
 import static org.elasticsearch.common.ssl.PemUtils.parsePKCS8PemString;
 import static org.elasticsearch.discovery.SettingsBasedSeedHostsProvider.DISCOVERY_SEED_HOSTS_SETTING;
 import static org.elasticsearch.xpack.core.security.CommandLineHttpClient.createURL;
+import static org.elasticsearch.xpack.security.cli.ConfigInitialNode.AUTO_CONFIGURATION_END_MARKER;
+import static org.elasticsearch.xpack.security.cli.ConfigInitialNode.AUTO_CONFIGURATION_START_MARKER;
 
 /**
  * Configures a node to join an existing cluster with security features enabled.
@@ -84,6 +87,10 @@ public class EnrollNodeToCluster extends KeyStoreAwareCommand {
     private final OptionSpec<String> enrollmentTokenParam = parser.accepts("enrollment-token", "The enrollment token to use")
         .withRequiredArg()
         .required();
+    private final OptionSpec<Void> force = parser.acceptsAll(
+        List.of("f", "force"),
+        "Overwrite existing configuration even when this is not a new node"
+    );
     private final BiFunction<Environment, String, CommandLineHttpClient> clientFunction;
 
     static final String TLS_CONFIG_DIR_NAME_PREFIX = "tls_auto_config_node_";
@@ -110,8 +117,9 @@ public static void main(String[] args) throws Exception {
 
     @Override
     protected void execute(Terminal terminal, OptionSet options, Environment env) throws Exception {
+        final boolean shouldForce = options.has(force);
 
-        if (Files.isDirectory(env.dataFile()) && Files.list(env.dataFile()).findAny().isPresent()) {
+        if (shouldForce == false && Files.isDirectory(env.dataFile()) && Files.list(env.dataFile()).findAny().isPresent()) {
             throw new UserException(
                 ExitCodes.CONFIG,
                 "Aborting enrolling to cluster. It appears that this is not the first time this node starts."
@@ -140,8 +148,7 @@ protected void execute(Terminal terminal, OptionSet options, Environment env) th
                 String.format(Locale.ROOT, "Aborting enrolling to cluster. The keystore [%s] is not a readable regular file", ymlPath)
             );
         }
-
-        checkExistingConfiguration(env.settings());
+        checkExistingConfiguration(env.settings(), shouldForce);
 
         final ZonedDateTime autoConfigDate = ZonedDateTime.now(ZoneOffset.UTC);
         final String instantAutoConfigName = TLS_CONFIG_DIR_NAME_PREFIX + autoConfigDate.toInstant().getEpochSecond();
@@ -169,7 +176,7 @@ protected void execute(Terminal terminal, OptionSet options, Environment env) th
         }
 
         final UserPrincipal newFileOwner = Files.getOwner(instantAutoConfigDir, LinkOption.NOFOLLOW_LINKS);
-        if (false == newFileOwner.equals(Files.getOwner(env.configFile(), LinkOption.NOFOLLOW_LINKS))) {
+        if (shouldForce == false && (false == newFileOwner.equals(Files.getOwner(env.configFile(), LinkOption.NOFOLLOW_LINKS)))) {
             Files.deleteIfExists(instantAutoConfigDir);
             throw new UserException(ExitCodes.CONFIG, "Aborting enrolling to cluster. config dir ownership mismatch");
         }
@@ -246,7 +253,7 @@ protected void execute(Terminal terminal, OptionSet options, Environment env) th
         final PrivateKey transportKey = transport.v1();
         final X509Certificate transportCert = transport.v2();
 
-        final X500Principal certificatePrincipal = new X500Principal("CN=Autogenerated by Elasticsearch");
+        final X500Principal certificatePrincipal = new X500Principal("CN="+System.getenv("HOSTNAME"));
         // this does DNS resolve and could block
         final GeneralNames subjectAltNames = getSubjectAltNames();
 
@@ -263,7 +270,7 @@ protected void execute(Terminal terminal, OptionSet options, Environment env) th
                 httpCaKey,
                 false,
                 HTTP_CERTIFICATE_DAYS,
-                null
+                "SHA256withRSA"
             );
         } catch (Exception e) {
             try {
@@ -279,7 +286,7 @@ protected void execute(Terminal terminal, OptionSet options, Environment env) th
         }
 
         try {
-            fullyWriteFile(instantAutoConfigDir, HTTP_AUTOGENERATED_CA_NAME + ".crt", false, stream -> {
+            fullyWriteFile(instantAutoConfigDir, HTTP_AUTOGENERATED_CA_NAME + ".crt", shouldForce, stream -> {
                 try (
                     JcaPEMWriter pemWriter =
                         new JcaPEMWriter(new BufferedWriter(new OutputStreamWriter(stream, StandardCharsets.UTF_8)))) {
@@ -324,11 +331,12 @@ protected void execute(Terminal terminal, OptionSet options, Environment env) th
             nodeKeystorePassword.set(new SecureString(terminal.readSecret("", KeyStoreWrapper.MAX_PASSPHRASE_LENGTH)));
             return nodeKeystorePassword.get().clone();
         })) {
-            // do not overwrite keystore entries
+            // do not overwrite keystore entries unless explicitly instructed to do so,
             // instead expect the user to manually remove them themselves
-            if (nodeKeystore.getSettingNames().contains("xpack.security.transport.ssl.keystore.secure_password")
+            if (shouldForce == false &&
+                (nodeKeystore.getSettingNames().contains("xpack.security.transport.ssl.keystore.secure_password")
                 || nodeKeystore.getSettingNames().contains("xpack.security.transport.ssl.truststore.secure_password")
-                || nodeKeystore.getSettingNames().contains("xpack.security.http.ssl.keystore.secure_password")) {
+                || nodeKeystore.getSettingNames().contains("xpack.security.http.ssl.keystore.secure_password"))) {
                 throw new UserException(
                     ExitCodes.CONFIG,
                     "Aborting enrolling to cluster. The node keystore contains TLS related settings already."
@@ -352,7 +360,7 @@ protected void execute(Terminal terminal, OptionSet options, Environment env) th
                 fullyWriteFile(
                     instantAutoConfigDir,
                     HTTP_AUTOGENERATED_KEYSTORE_NAME + ".p12",
-                    false,
+                    shouldForce,
                     stream -> httpKeystore.store(stream, httpKeystorePassword.getChars())
                 );
                 nodeKeystore.setString("xpack.security.http.ssl.keystore.secure_password", httpKeystorePassword.getChars());
@@ -373,7 +381,7 @@ protected void execute(Terminal terminal, OptionSet options, Environment env) th
                 fullyWriteFile(
                     instantAutoConfigDir,
                     TRANSPORT_AUTOGENERATED_KEYSTORE_NAME + ".p12",
-                    false,
+                    shouldForce,
                     stream -> transportKeystore.store(stream, transportKeystorePassword.getChars())
                 );
                 nodeKeystore.setString("xpack.security.transport.ssl.keystore.secure_password", transportKeystorePassword.getChars());
@@ -417,15 +425,24 @@ protected void execute(Terminal terminal, OptionSet options, Environment env) th
 
         // We have everything, let's write to the config
         try {
-            List<String> existingConfigLines = Files.readAllLines(ymlPath, StandardCharsets.UTF_8);
+            final List<String> existingConfigLines = Files.readAllLines(ymlPath, StandardCharsets.UTF_8);
+
             fullyWriteFile(env.configFile(), "elasticsearch.yml", true, stream -> {
                 try (BufferedWriter bw = new BufferedWriter(new OutputStreamWriter(stream, StandardCharsets.UTF_8))) {
+                    // Remove previous auto-configuration
+                    final List<String> existingConfigWithoutAutoconfiguration = Arrays.stream(
+                        existingConfigLines.stream()
+                            .collect(Collectors.joining(System.lineSeparator()))
+                            .replace("(?s)" + AUTO_CONFIGURATION_START_MARKER + ".*?" + AUTO_CONFIGURATION_END_MARKER, "")
+                            .split(System.lineSeparator())
+                    ).collect(Collectors.toList());
                     // start with the existing config lines
-                    for (String line : existingConfigLines) {
+                    for (String line : existingConfigWithoutAutoconfiguration) {
                         bw.write(line);
                         bw.newLine();
                     }
                     bw.newLine();
+                    bw.write(AUTO_CONFIGURATION_START_MARKER);
                     bw.newLine();
                     bw.write("###################################################################################");
                     bw.newLine();
@@ -507,6 +524,8 @@ protected void execute(Terminal terminal, OptionSet options, Environment env) th
                         bw.write(HttpTransportSettings.SETTING_HTTP_HOST.getKey() + ": [_local_, _site_]");
                         bw.newLine();
                     }
+                    bw.write(AUTO_CONFIGURATION_END_MARKER);
+                    bw.newLine();
                 }
             });
         } catch (Exception e) {
@@ -634,16 +653,18 @@ private Tuple<PrivateKey, X509Certificate> parseKeyCertFromPem(String pemFormatt
         }
     }
 
-    void checkExistingConfiguration(Settings settings) throws UserException {
-        if (XPackSettings.SECURITY_ENABLED.exists(settings)) {
-            throw new UserException(ExitCodes.CONFIG, "Aborting enrolling to cluster. It appears that security is already configured.");
-        }
+    void checkExistingConfiguration(Settings settings, boolean shouldForce) throws UserException {
         if (XPackSettings.ENROLLMENT_ENABLED.exists(settings) && false == XPackSettings.ENROLLMENT_ENABLED.get(settings)) {
             throw new UserException(ExitCodes.CONFIG, "Aborting enrolling to cluster. Enrollment is explicitly disabled.");
         }
-        if (false == settings.getByPrefix(XPackSettings.TRANSPORT_SSL_PREFIX).isEmpty() ||
-            false == settings.getByPrefix(XPackSettings.HTTP_SSL_PREFIX).isEmpty()) {
-            throw new UserException(ExitCodes.CONFIG, "Aborting enrolling to cluster. It appears that TLS is already configured.");
+        if (shouldForce == false) {
+            if (XPackSettings.SECURITY_ENABLED.exists(settings)) {
+                throw new UserException(ExitCodes.CONFIG, "Aborting enrolling to cluster. It appears that security is already configured.");
+            }
+            if (false == settings.getByPrefix(XPackSettings.TRANSPORT_SSL_PREFIX).isEmpty()
+                || false == settings.getByPrefix(XPackSettings.HTTP_SSL_PREFIX).isEmpty()) {
+                throw new UserException(ExitCodes.CONFIG, "Aborting enrolling to cluster. It appears that TLS is already configured.");
+            }
         }
     }
 

x-pack/plugin/security/cli/src/test/java/org/elasticsearch/xpack/security/cli/EnrollNodeToClusterTests.java

@@ -176,6 +176,20 @@ public void testEnrollmentExitsOnAlreadyConfiguredNode() throws Exception {
         assertAutoConfigurationFilesNotCreated();
     }
 
+    public void testEnrollmentDoesNotExitOnAlreadyConfiguredNodeIfForced() throws Exception {
+        final EnrollmentToken enrollmentToken = new EnrollmentToken(
+            randomAlphaOfLength(12),
+            randomAlphaOfLength(12),
+            Version.CURRENT.toString(),
+            List.of("127.0.0.1:9200")
+        );
+        Path dataDir = Files.createDirectory(jimfs.getPath("eshome").resolve("data"));
+        Files.createFile(dataDir.resolve("foo"));
+        settings = Settings.builder().put(settings).put("path.data", dataDir).put("xpack.security.enrollment.enabled", true).build();
+        execute("--enrollment-token", enrollmentToken.getEncoded(), randomFrom("-f", "--force"));
+        assertAutoConfigurationFilesCreated();
+    }
+
     public void testEnrollmentExitsOnInvalidEnrollmentToken() throws Exception {
         final EnrollmentToken enrollmentToken = new EnrollmentToken(
             randomAlphaOfLength(12),
@@ -231,6 +245,28 @@ public void testEnrollmentExitsOnExistingSecurityConfiguration() throws Exceptio
         assertAutoConfigurationFilesNotCreated();
     }
 
+    public void testEnrollmentDoesNotExitOnExistingSecurityConfigurationIfForced() throws Exception {
+        settings = Settings.builder().put(settings).put("xpack.security.enabled", true).build();
+        final EnrollmentToken enrollmentToken = new EnrollmentToken(
+            randomAlphaOfLength(12),
+            randomAlphaOfLength(12),
+            Version.CURRENT.toString(),
+            List.of("127.0.0.1:9200")
+        );
+        execute("--enrollment-token", enrollmentToken.getEncoded(), randomFrom("-f", "--force"));
+        final Path autoConfigDir = assertAutoConfigurationFilesCreated();
+        assertTransportKeystore(
+            autoConfigDir.resolve(TRANSPORT_AUTOGENERATED_KEYSTORE_NAME + ".p12"),
+            Paths.get(getClass().getResource("transport.key").toURI()).toAbsolutePath().normalize(),
+            Paths.get(getClass().getResource("transport.crt").toURI()).toAbsolutePath().normalize()
+        );
+        assertHttpKeystore(
+            autoConfigDir.resolve(HTTP_AUTOGENERATED_KEYSTORE_NAME + ".p12"),
+            Paths.get(getClass().getResource("http_ca.key").toURI()).toAbsolutePath().normalize(),
+            Paths.get(getClass().getResource("http_ca.crt").toURI()).toAbsolutePath().normalize()
+        );
+    }
+
     public void testEnrollmentExitsOnExistingTlsConfiguration() throws Exception {
         settings = Settings.builder()
             .put(settings)