Post

Day-3 Elasticsearch Setup

Posted Updated
By Cyberpengunine__
1 min read

day-3

  1. For this configuration, I utilized Vultr cloud service. To create the instance, I established a VPC in nearest region.

    vpc-create-1.png

  2. Configure the network settings. I used IP range 172.31.0.0/24. Give a name to your VPC network and add the network by clicking on Add Network.

    vpc-network-config.png

  3. Deploy the new server

    add-new-server.png

  4. Choose type as dedicated CPU and same region as VPC.

    choose-type-mumbai.png

  5. Choose Ubuntu 22.04 image for machine.

    choose-img-ubuntu.png

  6. Choose the plan suitable for elasticsearch

    choose-plan-80gb.png

  7. Choose the VPC we created for the elasticsearch server

    selected-vpc-for-instance.png

  8. Don’t need the ssh key here for now, but give a name to your server

    deploy-instance.png

  9. Click the Deploy Now button and we successfully deployed our server.

Install Elasticsearch:

  1. Update and upgrade packages: sudo apt-get update && apt-get upgrade -y

    update-machine.png

    The Elasticsearch DEB package for x86_64 architecture can be downloaded directly from the official Elasticsearch website.

    elasticserch-download-page.png

  2. Download Elasticsearch DEB package: wget <download link>

    download-elsaticsearch.png

  3. Install Elasticsearch: sudo dpkg -i <elasticsearch.deb>

    After installing the Elasticsearch DEB package, important security configuration details will be displayed on the terminal. Make sure to record these settings, including the Elasticsearch password. This information is crucial for resetting passwords if needed.

    ls.png

    unpack-elasticsearch.png

    security-config.png

Configure Elasticsearch:

  1. Navigate to the configuration file: cd /etc/elasticsearch

    cd-elasticsearch-dir.png

  2. Edit the configuration file: nano elasticsearch.yml

    By default, Elasticsearch is only accessible from the local host. For enhanced security and remote access, configure the network host setting to your system’s public IP address.

  3. Uncomment and modify network.host and http.port settings to allow remote access.

    set-yml-file.png

Start Elasticsearch Service:

To access Elasticsearch, we must activate and start the service after making the necessary changes.

  1. Reload systemd daemon: systemctl daemon-reload
  2. Enable Elasticsearch service at boot: systemctl enable elasticsearch.service
  3. Start Elasticsearch service: systemctl start elasticsearch.service

start-elasticsearch-service.png

Verify Service Status:

  • Check if Elasticsearch is running: systemctl status elasticsearch.service
MYDFIR 30Day SOC_Challenge
soc_challenge soc cybersecurity day3of30
This post is licensed under CC BY 4.0 by the author.