Setting up elastic stack

Setup for debian or ubuntu

In case of a virtual server you might have to disable sysctl updates:

>systemctl mask systemd-sysctl.service
Created symlink from /etc/systemd/system/systemd-sysctl.service to /dev/null.

Add the package source and its gpg keys:

apt-get install apt-transport-https
echo "deb https://artifacts.elastic.co/packages/6.x/apt stable main" > /etc/apt/sources.list.d/elastic-6.x.list
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | apt-key add -
apt-get update

And now install a bunch of packages:

apt-get install elasticsearch
systemctl start elasticsearch
systemctl enable elasticsearch
apt-get install kibana
systemctl start kibana
systemctl enable kibana
apt-get install logstash
systemctl start logstash
systemctl enable logstash

Add reverse proxy for kibana web access

Use nginx as a reverse proxy in front of all localhost listening processes. Therefore add that file to /etc/nginx/sites-available/kiba.conf and activate it.

upstream app_kibana {
        server 127.0.0.1:5601;
        keepalive 8;
}

server {
        listen 80;
        listen [::]:80;
        server_name kiba.example.com;

        error_log       /var/log/nginx/kibana_err.log warn;
        access_log      /var/log/nginx/kibana_access.log combined;

        return 301 https://$server_name$request_uri;
}

server {
        listen 443 ssl http2;
        listen [::]:443 ssl http2;

        include snippets/ssl-kibana.conf;
        include snippets/ssl-params.conf;
        include snippets/auth.conf;

        error_log       /var/log/nginx/kibana_err.log warn;
        access_log      /var/log/nginx/kibana_access.log combined;

        root /var/www/html;

        # Add index.php to the list if you are using PHP
        index index.html index.htm index.nginx-debian.html;

        location ~ /.well-known {
                allow all;
        }

        server_name kiba.example.com;

        set $http_x_forwarded_proto  $scheme;

        chunked_transfer_encoding on;
        client_max_body_size 0;
        location / {
                proxy_read_timeout  900;
                proxy_pass_header   Server;
                proxy_cookie_path   ~*^/.* /;

                proxy_pass         http://app_kibana/;
                proxy_redirect     off;
                proxy_http_version 1.1;

                proxy_set_header    X-Forwarded-Port  $server_port;
                proxy_set_header    X-Forwarded-Proto $http_x_forwarded_proto;
                proxy_set_header    Host              $http_host;
                proxy_set_header    X-Forwarded-For   $proxy_add_x_forwarded_for;
        }
}

The included subfiles snippets/auth.conf is for securing access:

auth_basic "Restricted";
auth_basic_user_file /etc/nginx/snippets/htpasswd;

And the two ssl files are for tha mandatory encryption. first snippets/ssl-kibana.conf

ssl_certificate /etc/letsencrypt/live/kiba.example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/kiba.example.com/privkey.pem;

and second snippets/ssl-params.conf

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
ssl_ecdh_curve secp384r1;
ssl_session_cache shared:SSL:10m;
ssl_session_tickets off;
ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 5s;
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
ssl_dhparam /etc/ssl/certs/dhparam.pem;