{"action":"created","issue":{"url":"https://api.github.com/repos/elastic/puppet-elasticsearch/issues/567","labels_url":"https://api.github.com/repos/elastic/puppet-elasticsearch/issues/567/labels{/name}","comments_url":"https://api.github.com/repos/elastic/puppet-elasticsearch/issues/567/comments","events_url":"https://api.github.com/repos/elastic/puppet-elasticsearch/issues/567/events","html_url":"https://github.com/elastic/puppet-elasticsearch/issues/567","id":129559750,"number":567,"title":"Shield - key_file","user":{"login":"pricecarl","id":12760386,"avatar_url":"https://avatars.githubusercontent.com/u/12760386?v=3","gravatar_id":"","url":"https://api.github.com/users/pricecarl","html_url":"https://github.com/pricecarl","followers_url":"https://api.github.com/users/pricecarl/followers","following_url":"https://api.github.com/users/pricecarl/following{/other_user}","gists_url":"https://api.github.com/users/pricecarl/gists{/gist_id}","starred_url":"https://api.github.com/users/pricecarl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pricecarl/subscriptions","organizations_url":"https://api.github.com/users/pricecarl/orgs","repos_url":"https://api.github.com/users/pricecarl/repos","events_url":"https://api.github.com/users/pricecarl/events{/privacy}","received_events_url":"https://api.github.com/users/pricecarl/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":7,"created_at":"2016-01-28T19:48:09Z","updated_at":"2016-01-29T09:27:32Z","closed_at":null,"body":"Hello,\r\nI am trying to setup ElasticSearch via your puppet module.\r\n\r\nHowever I have hit a problem and I'm not sure if it is with puppet or shield.\r\nI have multiple nodes on a single server which puppet can do quite easily. The problem is when I try to install the shield plugin (via puppet) I get this error:\r\n\r\n    java.security.AccessControlException: access denied (\"java.io.FilePermission\" \"/etc/elasticsearch/shield/system_key\" \"read\")\r\n        at java.security.AccessControlContext.checkPermission(AccessControlContext.java:457)\r\n        at java.security.AccessController.checkPermission(AccessController.java:884)\r\n        at java.lang.SecurityManager.checkPermission(SecurityManager.java:549)\r\n        at java.lang.SecurityManager.checkRead(SecurityManager.java:888)\r\n        at sun.nio.fs.UnixPath.checkRead(UnixPath.java:795)\r\n        at sun.nio.fs.UnixFileSystemProvider.checkAccess(UnixFileSystemProvider.java:290)\r\n        at java.nio.file.Files.exists(Files.java:2385)\r\n        at org.elasticsearch.shield.crypto.InternalCryptoService.readSystemKey(InternalCryptoService.java:185)\r\n        at org.elasticsearch.shield.crypto.InternalCryptoService.loadKeys(InternalCryptoService.java:133)\r\n        at org.elasticsearch.shield.crypto.InternalCryptoService.doStart(InternalCryptoService.java:115)\r\n        at org.elasticsearch.common.component.AbstractLifecycleComponent.start(AbstractLifecycleComponent.java:68)\r\n        at org.elasticsearch.node.Node.start(Node.java:242)\r\n        at org.elasticsearch.bootstrap.Bootstrap.start(Bootstrap.java:221)\r\n        at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:287)\r\n        at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:35)\r\n\r\nThe way I have the node set up is like this:\r\n\r\n    [root@localhost shield]# cd /etc/elasticsearch/\r\n    [root@localhost elasticsearch]# ll\r\n    total 28\r\n    drwxr-xr-x. 2 elasticsearch elasticsearch 4096 Jan 28 17:03 es-c01\r\n    drwxr-xr-x. 2 elasticsearch elasticsearch 4096 Jan 28 17:03 es-d01\r\n    drwxr-xr-x. 2 elasticsearch elasticsearch 4096 Jan 28 17:03 es-d02\r\n    drwxr-xr-x. 2 elasticsearch elasticsearch 4096 Jan 28 17:10 es-m01\r\n    drwxr-xr-x. 2 elasticsearch elasticsearch 4096 Jan 28 17:03 es-m02\r\n    drwxr-x---. 2 elasticsearch elasticsearch 4096 Dec 15 13:37 scripts\r\n    drwxr-xr-x  2 elasticsearch elasticsearch 4096 Jan 28 17:11 shield\r\n\r\nthe shield directory above contains the roles.yml file etc...\r\n\r\nin each of the node folders is a symlink to the shield folder above (so all the nodes pick up the same shield configuration files) so /etc/elasticsearch/es-m01/shield ->  /etc/elasticsearch/shield and /etc/elasticsearch/es-m02/shield -> /etc/elasticsearch/shield and so on …\r\n\r\nI have gone through the docs:\r\n\r\nhttps://www.elastic.co/guide/en/shield/current/enable-message-authentication.html\r\n\r\nand have the key in the right place (/etc/elasticsearch/shield/system_key) with the right permissions and the elasticsearch user is able to read it fine. But ES keeps refusing to start throwing that error. I have also tried adding the setting shield.system_key.file: /etc/elasticsearch/shield/system_key to the elasticsearch.yml file but this doesn’t seem to make and different.\r\n\r\nIf I put the key_file in /etc/elasticsearch/es-m01/shield without the syml link to /etc/elasticsearch/shield the node starts fine. Does this mean shield can’t follow symlinks?\r\n\r\nHas anyone else come across this problem and managed to solve it? Or do you have a better way I can achieve this?\r\n"},"comment":{"url":"https://api.github.com/repos/elastic/puppet-elasticsearch/issues/comments/176660646","html_url":"https://github.com/elastic/puppet-elasticsearch/issues/567#issuecomment-176660646","issue_url":"https://api.github.com/repos/elastic/puppet-elasticsearch/issues/567","id":176660646,"user":{"login":"pricecarl","id":12760386,"avatar_url":"https://avatars.githubusercontent.com/u/12760386?v=3","gravatar_id":"","url":"https://api.github.com/users/pricecarl","html_url":"https://github.com/pricecarl","followers_url":"https://api.github.com/users/pricecarl/followers","following_url":"https://api.github.com/users/pricecarl/following{/other_user}","gists_url":"https://api.github.com/users/pricecarl/gists{/gist_id}","starred_url":"https://api.github.com/users/pricecarl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pricecarl/subscriptions","organizations_url":"https://api.github.com/users/pricecarl/orgs","repos_url":"https://api.github.com/users/pricecarl/repos","events_url":"https://api.github.com/users/pricecarl/events{/privacy}","received_events_url":"https://api.github.com/users/pricecarl/received_events","type":"User","site_admin":false},"created_at":"2016-01-29T09:27:32Z","updated_at":"2016-01-29T09:27:32Z","body":"Nope that doesn't work either"}}