### Install Fleet Server

Source: https://www.elastic.co/guide/en/elastic-stack/current/install-stack-demo-secure.html

Execute the installation command with SSL and service token parameters.

```bash
sudo ./elastic-agent install -url=https://10.128.0.208:8220 \
  --fleet-server-es=https://10.128.0.84:9200 \
  --fleet-server-service-token=<token> \
  --fleet-server-policy=fleet-server-policy \
  --fleet-server-es-ca-trusted-fingerprint=<fingerprint> \
  --certificate-authorities=/etc/fleet/es-ca.crt \
  --fleet-server-cert=/etc/fleet/fleet-server.crt \
  --fleet-server-cert-key=/etc/fleet/fleet-server.key \
  --fleet-server-port=8220
```

--------------------------------

### Create and navigate to installation directory

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

Prepare a dedicated directory for downloading the Elasticsearch installation files.

```bash
mkdir elastic-install-files
```

```bash
cd elastic-install-files
```

--------------------------------

### Create and navigate to installation directory

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

Commands to prepare the local environment for the Elastic Agent installation package.

```bash
mkdir agent-install-files
```

```bash
cd agent-install-files
```

--------------------------------

### Create Kibana installation directory

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

Prepare a working directory for the Kibana installation files.

```bash
mkdir kibana-install-files
```

--------------------------------

### Create installation directory

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

Create a dedicated directory for storing Elasticsearch installation files.

```bash
mkdir elastic-install-files
```

--------------------------------

### Install Elasticsearch

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

Install the Elasticsearch RPM package.

```bash
sudo rpm --install elasticsearch-9.3.3-x86_64.rpm
```

--------------------------------

### Elasticsearch Node Initialization Log Entries

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

Example log output indicating a new Elasticsearch node is initializing, starting transport, and attempting to join the cluster. Pay attention to `publish_address` and `bound_addresses`.

```log
[<instance-2>] Security is enabled
[<instance-2>] Profiling is enabled
[<instance-2>] using discovery type [multi-node] and seed hosts providers [settings]
[<instance-2>] initialized
[<instance-2>] starting ...
[<instance-2>] publish_address {<node-ip>:9300}, bound_addresses {[::]:9300}
[<instance-2>] master not discovered or elected yet ...
```

--------------------------------

### Change directory

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

Navigate into the newly created installation directory.

```bash
cd elastic-install-files
```

--------------------------------

### Navigate to Fleet Server Directory

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

Change into the newly created directory to proceed with the installation.

```bash
cd fleet-install-files
```

--------------------------------

### Install Kibana RPM

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

Install the Kibana package using the RPM manager.

```bash
sudo rpm --install kibana-9.3.3-x86_64.rpm
```

--------------------------------

### Kibana Verification Prompt Example

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

This is an example of the output from the `status` command, showing the URL and verification code needed to access Kibana for the first time.

```text
Kibana has not been configured.
Go to http://203.0.113.31:5601/?code=<code> to get started.
		
```

--------------------------------

### NGINX Configuration for Elastic Artifact Registry

Source: https://www.elastic.co/guide/en/elastic-stack/current/air-gapped-install.html

Example NGINX configuration for serving the Elastic Artifact Registry. Ensure NGINX is installed and configured to use this file.

```nginx
user  nginx;
worker_processes  2;

error_log  /var/log/nginx/error.log notice;
pid        /var/run/nginx.pid;

events {
    worker_connections  1024;
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log          /var/log/nginx/access.log  main;
    sendfile            on;
    keepalive_timeout   65;

    server {
        listen                  9080 default_server;
        server_name             _;
        root                    /opt/elastic-packages;

        location / {

        }
    }

}

```

--------------------------------

### Cluster Nodes Output Example

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

Example output from the `_cat/nodes?v` API, listing nodes in the cluster with their IP addresses, status, and roles. The new node (`instance-2`) should appear in this list.

```text
203.0.113.22 46 97 18 0.21 0.23 0.10 cdfhilmrstw - instance-2
203.0.113.21 31 96  1 0.04 0.03 0.01 cdfhilmrstw * instance-1
```

--------------------------------

### Start Kibana Service

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

Use this command to start the Kibana service. If needed, you can stop it using `sudo systemctl stop kibana.service`.

```bash
sudo systemctl start kibana.service
		
```

--------------------------------

### Import GPG key and install Elasticsearch

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

Import the official Elastic GPG key for signature verification and install the RPM package.

```bash
sudo rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
```

```bash
sudo rpm --install elasticsearch-9.3.3-x86_64.rpm
```

--------------------------------

### Verify SSL Configuration Log

Source: https://www.elastic.co/guide/en/elastic-stack/current/install-stack-demo-secure.html

Example log output confirming that security is enabled.

```text
[2023-07-12T13:11:29,154][INFO ][o.e.x.s.Security         ] [es-ssl-test] Security is enabled
```

--------------------------------

### Change directory to Kibana installation folder

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

Navigate into the created directory before downloading packages.

```bash
cd kibana-install-files
```

--------------------------------

### Install Elastic Agent

Source: https://www.elastic.co/guide/en/elastic-stack/current/install-stack-demo-secure.html

Command to install and enroll the Elastic Agent with the Fleet Server using a CA certificate.

```bash
sudo ./elastic-agent install \
--url=https://10.128.0.203:8220 \
--enrollment-token=<token> \
--certificate-authorities=/etc/agent/es-ca.crt
```

--------------------------------

### Start Elasticsearch Service

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

Start the Elasticsearch service using `systemctl`. You can stop it with `sudo systemctl stop elasticsearch.service`.

```bash
sudo systemctl start elasticsearch.service
		
```

--------------------------------

### Install Elastic Agent with enrollment token

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

Command to install and enroll the agent, including the --insecure flag required for self-signed certificates.

```bash
sudo ./elastic-agent install --url=https://203.0.113.41:8220 --enrollment-token=VWCobFhKd0JuUnppVYQxX0VKV5E6UmU3BGk0ck9RM2HzbWEmcS4Bc1YUUM== --insecure
```

--------------------------------

### Enable Kibana systemd service

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

Reload systemd and enable the Kibana service to start on boot.

```bash
sudo systemctl daemon-reload
sudo systemctl enable kibana.service
```

--------------------------------

### Start Elasticsearch Service

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

Command to start the Elasticsearch service on a node. Ensure the service name is correct for your system.

```bash
sudo systemctl start elasticsearch.service
```

--------------------------------

### SystemD Service File for EPR (Latest)

Source: https://www.elastic.co/guide/en/elastic-stack/current/air-gapped-install.html

This is an example of a SystemD service file for EPR, launched as a Podman service, using the latest Docker image.

```systemd
# container-elastic-epr.service
# autogenerated by Podman 4.1.1
# Wed Oct 19 13:12:33 UTC 2022

[Unit]
Description=Podman container-elastic-epr.service
Documentation=man:podman-generate-systemd(1)
Wants=network-online.target
After=network-online.target
RequiresMountsFor=%t/containers

[Service]
Environment=PODMAN_SYSTEMD_UNIT=%n
Restart=always
TimeoutStopSec=70
ExecStartPre=/bin/rm -f %t/%n.ctr-id
ExecStart=/usr/bin/podman run \
  --cidfile=%t/%n.ctr-id \
  --cgroups=no-conmon \
  --rm \
  --sdnotify=conmon \
  -d \
  --replace \
  --name elastic-epr \
  -p 0.0.0.0:8443:8443 \
  -v /etc/elastic/epr/epr.pem:/etc/ssl/epr.crt:ro \
  -v /etc/elastic/epr/epr-key.pem:/etc/ssl/epr.key:ro \
  -e EPR_ADDRESS=0.0.0.0:8443 \
  -e EPR_TLS_CERT=/etc/ssl/epr.crt \
  -e EPR_TLS_KEY=/etc/ssl/epr.key docker.elastic.co/package-registry/distribution:9.3.3
ExecStop=/usr/bin/podman stop --ignore --cidfile=%t/%n.ctr-id
ExecStopPost=/usr/bin/podman rm -f --ignore --cidfile=%t/%n.ctr-id
Type=notify
NotifyAccess=all

[Install]
WantedBy=default.target
		
```

--------------------------------

### Verify Elastic Agent installation status

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

Expected output message confirming the successful installation of the Elastic Agent service.

```text
Elastic Agent has been successfully installed.
```

--------------------------------

### Create Fleet Server Working Directory

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

Use this command to create a dedicated directory for Fleet Server installation files.

```bash
mkdir fleet-install-files
```

--------------------------------

### Manage Elasticsearch Service

Source: https://www.elastic.co/guide/en/elastic-stack/current/install-stack-demo-secure.html

Commands to start and verify the status of the Elasticsearch service.

```bash
sudo systemctl start elasticsearch.service
```

```bash
sudo systemctl status elasticsearch.service
```

--------------------------------

### Start Kibana Service

Source: https://www.elastic.co/guide/en/elastic-stack/current/install-stack-demo-secure.html

Restart the Kibana service to apply the new SSL and security configurations. This command initiates the Kibana process.

```bash
sudo systemctl start kibana.service
```

--------------------------------

### Elasticsearch Node Started Log Entry

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

Log message confirming that the Elasticsearch node has successfully started and is operational within the cluster.

```log
[<instance-2>] started {<instance-2>}...
```

--------------------------------

### Configure Kibana Fleet Output

Source: https://www.elastic.co/guide/en/elastic-stack/current/install-stack-demo-secure.html

Example configuration for xpack.fleet.outputs in kibana.yml including the CA fingerprint.

```yaml
xpack.fleet.outputs: [{id: fleet-default-output, name: default, is_default: true, is_default_monitoring: true, type: elasticsearch, hosts: [`https://10.128.0.84:9200`], ca_trusted_fingerprint: 92b51cf91e7fa311f8c84849224d448ca44824eb}]
```

--------------------------------

### Enable Elasticsearch as a systemd service

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

Reload the systemd daemon and enable the Elasticsearch service to ensure it starts automatically on boot.

```bash
sudo systemctl daemon-reload
sudo systemctl enable elasticsearch.service
```

--------------------------------

### Example Elasticsearch Response

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

A successful response from the Elasticsearch API indicates the node is running and configured correctly.

```json
{
  "name" : "instance-1",
  "cluster_name" : "elasticsearch-demo",
  "cluster_uuid" : "<cluster-uuid>",
  "version" : {
    "number" : "9.3.3",
    "build_flavor" : "default",
    "build_type" : "rpm",
    ...
  },
  "tagline" : "You Know, for Search"
}
		
```

--------------------------------

### Manage Kibana Service

Source: https://www.elastic.co/guide/en/elastic-stack/current/install-stack-demo-secure.html

Commands to stop and start the Kibana service during configuration updates.

```bash
sudo systemctl stop kibana.service
```

```bash
sudo systemctl start kibana.service
```

--------------------------------

### Verify Elasticsearch Service Status

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

Check the status of the Elasticsearch service to confirm it started successfully. Type `q` to exit the status view.

```bash
sudo systemctl status elasticsearch
		
```

--------------------------------

### Move CA Certificate to Kibana Host

Source: https://www.elastic.co/guide/en/elastic-stack/current/install-stack-demo-secure.html

Copy the Elasticsearch CA certificate to the Kibana configuration directory. Ensure the path matches your Kibana installation.

```bash
mv elasticsearch-ca.pem /etc/kibana
```

--------------------------------

### Elasticsearch Node Status Response

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

Example JSON response from a `curl` request to an Elasticsearch node, showing its name, cluster information, and version.

```json
{
    "name" : "instance-2",
    "cluster_name" : "elasticsearch-demo",
    "cluster_uuid" : "<cluster-uuid>",
    "version" : {
    "number" : "9.3.3",
    "build_flavor" : "default",
    "build_type" : "rpm",
    ...
    },
    "tagline" : "You Know, for Search"
}
```

--------------------------------

### Move new keystore to configuration directory

Source: https://www.elastic.co/guide/en/elastic-stack/current/install-stack-demo-secure.html

Moves the new http.p12 file into the Elasticsearch certificates directory.

```bash
sudo mv /usr/share/elasticsearch/elasticsearch/<es1-hostname>/http.p12 /etc/elasticsearch/certs/
```

--------------------------------

### Prepare Elastic Agent Directory

Source: https://www.elastic.co/guide/en/elastic-stack/current/install-stack-demo-secure.html

Commands to create the directory for the Elasticsearch certificate.

```bash
sudo mkdir /etc/agent
```

--------------------------------

### Create Fleet certificate directory

Source: https://www.elastic.co/guide/en/elastic-stack/current/install-stack-demo-secure.html

Create the directory on the Fleet Server host to store certificate files.

```bash
sudo mkdir /etc/fleet
```

--------------------------------

### Open Elasticsearch Configuration File

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

Use `vim` to open the Elasticsearch configuration file. Ensure you have the necessary permissions.

```bash
sudo vim /etc/elasticsearch/elasticsearch.yml
		
```

--------------------------------

### Truststore Entry Details

Source: https://www.elastic.co/guide/en/elastic-stack/current/install-stack-demo-secure.html

The output of the `keytool -list` command should display the details of the newly added CA certificate, confirming its successful import into the truststore.

```text
Keystore type: jks
Keystore provider: SUN
Your keystore contains 1 entry
new-ca, Jul 12, 2023, trustedCertEntry,
Certificate fingerprint (SHA-256): F0:86:6B:57:FC...
		
```

--------------------------------

### Generate enrollment token

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

Create a node enrollment token on an existing cluster node.

```bash
sudo /usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s node
```

--------------------------------

### Get CA fingerprint

Source: https://www.elastic.co/guide/en/elastic-stack/current/install-stack-demo-secure.html

Retrieve the SHA256 fingerprint of the CA certificate for secure Fleet Server communication.

```bash
grep -v ^- /etc/elasticsearch/certs/ca/ca.crt | base64 -d | sha256sum
```

--------------------------------

### Import GPG key

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

Import the Elasticsearch GPG key to verify the package signature.

```bash
sudo rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
```

--------------------------------

### List CA Certificate Files

Source: https://www.elastic.co/guide/en/elastic-stack/current/install-stack-demo-secure.html

Verify that the CA certificate and key files have been successfully unpacked. The `ca.crt` file is the public certificate, and `ca.key` is the private key.

```bash
sudo ls /etc/elasticsearch/certs/ca/
		
```

--------------------------------

### List Elasticsearch Keystore Contents

Source: https://www.elastic.co/guide/en/elastic-stack/current/install-stack-demo-secure.html

List the contents of the Elasticsearch keystore to verify entries.

```bash
/usr/share/elasticsearch/bin/elasticsearch-keystore list
		
```

--------------------------------

### Move CA Certificate Archive

Source: https://www.elastic.co/guide/en/elastic-stack/current/install-stack-demo-secure.html

Transfer the generated CA certificate archive to the Elasticsearch certificates directory. This directory is typically created automatically during installation.

```bash
sudo mv /usr/share/elasticsearch/elastic-stack-ca.zip /etc/elasticsearch/certs/
		
```

--------------------------------

### View Kibana Log File

Source: https://www.elastic.co/guide/en/elastic-stack/current/install-stack-demo-secure.html

Monitor the Kibana log file for detailed information and to confirm successful startup. Look for the 'Kibana is now available' message.

```bash
tail -f /var/log/kibana/kibana.log
```

--------------------------------

### Generate HTTP layer certificates

Source: https://www.elastic.co/guide/en/elastic-stack/current/install-stack-demo-secure.html

Initiates the certificate utility for the HTTP layer.

```bash
sudo /usr/share/elasticsearch/bin/elasticsearch-certutil http
```

--------------------------------

### Download Kibana RPM and checksum

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

Retrieve the Kibana package and its corresponding SHA512 checksum file.

```bash
curl -L -O https://artifacts.elastic.co/downloads/kibana/kibana-9.3.3-x86_64.rpm
curl -L -O https://artifacts.elastic.co/downloads/kibana/kibana-9.3.3-x86_64.rpm.sha512
```

--------------------------------

### Set Directory Permissions

Source: https://www.elastic.co/guide/en/elastic-stack/current/install-stack-demo-secure.html

Sets executable permissions for the certificate directories.

```bash
sudo chmod 750 /etc/elasticsearch/certs
sudo chmod 750 /etc/elasticsearch/certs/ca
```

--------------------------------

### Define output zip filename

Source: https://www.elastic.co/guide/en/elastic-stack/current/install-stack-demo-secure.html

Specify the destination path and filename for the generated certificate archive.

```text
What filename should be used for the output zip file? [/usr/share/elasticsearch/elasticsearch-ssl-http.zip] /etc/elasticsearch/certs/elasticsearch-ssl-http.zip
```

--------------------------------

### Generate Fleet Server certificate bundle

Source: https://www.elastic.co/guide/en/elastic-stack/current/install-stack-demo-secure.html

Use the elasticsearch-certutil utility to create a PEM-encoded certificate bundle for the Fleet Server host.

```bash
sudo /usr/share/elasticsearch/bin/elasticsearch-certutil cert --name fleet-server --ca-cert /etc/elasticsearch/certs/ca/ca.crt --ca-key /etc/elasticsearch/certs/ca/ca.key  --dns <DNS name> --ip <IP address> --pem
```

--------------------------------

### Expected verification output

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

The output confirming the package is valid.

```text
kibana-9.3.3-x86_64.rpm: OK
```

--------------------------------

### Verify certificate file structure

Source: https://www.elastic.co/guide/en/elastic-stack/current/install-stack-demo-secure.html

Lists the contents of the extracted certificate directories.

```bash
ls -lR /usr/share/elasticsearch/elasticsearch /usr/share/elasticsearch/kibana
```

```text
elasticsearch:
total 0
drwxr-xr-x. 2 root root 56 Dec 12 19:13 mynode-es1
...
kibana:
total 12
-rw-r--r--. 1 root root 1200 Dec 12 19:04 elasticsearch-ca.pem
...
```

--------------------------------

### Download Elasticsearch RPM and checksum

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

Retrieve the Elasticsearch RPM package and its corresponding SHA512 checksum file from the Elastic Artifact Registry.

```bash
curl -L -O https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-9.3.3-x86_64.rpm
curl -L -O https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-9.3.3-x86_64.rpm.sha512
```

--------------------------------

### SystemD Service File for EPR (Specific Version)

Source: https://www.elastic.co/guide/en/elastic-stack/current/air-gapped-install.html

This SystemD service file is for EPR launched as a Podman service, using a specific version of the Docker image. Replace `<SPECIFIC.VERSION.NUMBER>` with the desired Elastic Stack version.

```systemd
# container-elastic-epr.service
# autogenerated by Podman 4.1.1
# Wed Oct 19 13:12:33 UTC 2022

[Unit]
Description=Podman container-elastic-epr.service
Documentation=man:podman-generate-systemd(1)
Wants=network-online.target
After=network-online.target
RequiresMountsFor=%t/containers

[Service]
Environment=PODMAN_SYSTEMD_UNIT=%n
Restart=always
TimeoutStopSec=70
ExecStartPre=/bin/rm -f %t/%n.ctr-id
ExecStart=/usr/bin/podman run \
  --cidfile=%t/%n.ctr-id \
  --cgroups=no-conmon \
  --rm \
  --sdnotify=conmon \
  -d \
  --replace \
  --name elastic-epr \
  -p 0.0.0.0:8443:8443 \
  -v /etc/elastic/epr/epr.pem:/etc/ssl/epr.crt:ro \
  -v /etc/elastic/epr/epr-key.pem:/etc/ssl/epr.key:ro \
  -e EPR_ADDRESS=0.0.0.0:8443 \
  -e EPR_TLS_CERT=/etc/ssl/epr.crt \
  -e EPR_TLS_KEY=/etc/ssl/epr.key docker.elastic.co/package-registry/distribution:<SPECIFIC.VERSION.NUMBER>
ExecStop=/usr/bin/podman stop --ignore --cidfile=%t/%n.ctr-id
ExecStopPost=/usr/bin/podman rm -f --ignore --cidfile=%t/%n.ctr-id
Type=notify
NotifyAccess=all

[Install]
WantedBy=default.target
		
```

--------------------------------

### List Truststore Contents

Source: https://www.elastic.co/guide/en/elastic-stack/current/install-stack-demo-secure.html

Confirm that the CA certificate has been successfully added to the keystore by listing its contents. You will be prompted for the truststore password.

```bash
sudo /usr/share/elasticsearch/jdk/bin/keytool -keystore /etc/elasticsearch/certs/elastic-stack-ca.p12 -list
		
```

--------------------------------

### Tail Elasticsearch Log File

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

Monitor the Elasticsearch log file in real-time to observe startup and cluster join processes. Replace `elasticsearch-demo` with your cluster name if different.

```bash
sudo tail -f /var/log/elasticsearch/elasticsearch-demo.log
```

--------------------------------

### Set Certificate File Permissions

Source: https://www.elastic.co/guide/en/elastic-stack/current/install-stack-demo-secure.html

Configures read and write access for certificate files to ensure security.

```bash
sudo chmod 640 /etc/elasticsearch/certs/elastic-certificates.p12
sudo chmod 640 /etc/elasticsearch/certs/elastic-stack-ca.p12
sudo chmod 640 /etc/elasticsearch/certs/http_ca.crt
sudo chmod 640 /etc/elasticsearch/certs/http.p12
```

--------------------------------

### Generate SystemD Service File for EPR (Latest)

Source: https://www.elastic.co/guide/en/elastic-stack/current/air-gapped-install.html

Use this script to generate a SystemD service file for EPR using the latest Docker image on RHEL 8.

```bash
#!/usr/bin/env bash

EPR_BIND_ADDRESS="0.0.0.0"
EPR_BIND_PORT="8443"
EPR_TLS_CERT="/etc/elastic/epr/epr.pem"
EPR_TLS_KEY="/etc/elastic/epr/epr-key.pem"
EPR_IMAGE="docker.elastic.co/package-registry/distribution:9.3.3"

podman create \
  --name "elastic-epr" \
  -p "$EPR_BIND_ADDRESS:$EPR_BIND_PORT:$EPR_BIND_PORT" \
  -v "$EPR_TLS_CERT:/etc/ssl/epr.crt:ro" \
  -v "$EPR_TLS_KEY:/etc/ssl/epr.key:ro" \
  -e "EPR_ADDRESS=0.0.0.0:$EPR_BIND_PORT" \
  -e "EPR_TLS_CERT=/etc/ssl/epr.crt" \
  -e "EPR_TLS_KEY=/etc/ssl/epr.key" \
  "$EPR_IMAGE"

## creates service file in the root directory
# podman generate systemd --new --files --name elastic-epr --restart-policy always
		
```

--------------------------------

### Reconfigure node for cluster

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

Use the enrollment token to reconfigure the new node to join the existing cluster.

```bash
sudo /usr/share/elasticsearch/bin/elasticsearch-reconfigure-node --enrollment-token <enrollment-token>
```

--------------------------------

### Copy Kibana Certificate and Key

Source: https://www.elastic.co/guide/en/elastic-stack/current/install-stack-demo-secure.html

Move the generated Kibana server certificate and private key to the Kibana configuration directory.

```bash
sudo cp kibana-server.crt /etc/kibana/
sudo cp kibana-server.key /etc/kibana/
```

--------------------------------

### Edit configuration file

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

Open the Elasticsearch configuration file for editing.

```bash
sudo vim /etc/elasticsearch/elasticsearch.yml
```

--------------------------------

### Verify RPM checksum

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

Verify the integrity of the downloaded RPM file using the checksum file.

```bash
sha512sum -c elasticsearch-9.3.3-x86_64.rpm.sha512
```

--------------------------------

### Verify Kibana package integrity

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

Validate the downloaded RPM file using the checksum.

```bash
sha512sum -c kibana-9.3.3-x86_64.rpm.sha512
```

--------------------------------

### Download Latest Elastic Artifacts Script

Source: https://www.elastic.co/guide/en/elastic-stack/current/air-gapped-install.html

This script downloads the latest Elastic Stack artifacts for Linux and Windows. Ensure the DOWNLOAD_BASE_DIR environment variable is set before running.

```bash
#!/usr/bin/env bash
set -o nounset -o errexit -o pipefail

STACK_VERSION=9.3.3
ARTIFACT_DOWNLOADS_BASE_URL=https://artifacts.elastic.co/downloads

DOWNLOAD_BASE_DIR=${DOWNLOAD_BASE_DIR:?"Make sure to set DOWNLOAD_BASE_DIR when running this script"}

COMMON_PACKAGE_PREFIXES="apm-server/apm-server beats/auditbeat/auditbeat beats/elastic-agent/elastic-agent beats/filebeat/filebeat beats/heartbeat/heartbeat beats/metricbeat/metricbeat beats/osquerybeat/osquerybeat beats/packetbeat/packetbeat cloudbeat/cloudbeat endpoint-dev/endpoint-security fleet-server/fleet-server"

WIN_ONLY_PACKAGE_PREFIXES="beats/winlogbeat/winlogbeat"

RPM_PACKAGES="beats/elastic-agent/elastic-agent"
DEB_PACKAGES="beats/elastic-agent/elastic-agent"

function download_packages() {
  local url_suffix="$1"
  local package_prefixes="$2"

  local _url_suffixes="$url_suffix ${url_suffix}.sha512 ${url_suffix}.asc"
  local _pkg_dir=""
  local _dl_url=""

  for _download_prefix in $package_prefixes; do
    for _pkg_url_suffix in $_url_suffixes; do
          _pkg_dir=$(dirname ${DOWNLOAD_BASE_DIR}/${_download_prefix})
          _dl_url="${ARTIFACT_DOWNLOADS_BASE_URL}/${_download_prefix}-${_pkg_url_suffix}"
          (mkdir -p $_pkg_dir && cd $_pkg_dir && curl -O "$_dl_url")
    done
  done
}

# and we download
for _os in linux windows; do
  case "$_os" in
    linux)
      PKG_URL_SUFFIX="${STACK_VERSION}-${_os}-x86_64.tar.gz"
      ;;
    windows)
      PKG_URL_SUFFIX="${STACK_VERSION}-${_os}-x86_64.zip"
      ;;
    *)
      echo "[ERROR] Something happened"
      exit 1
      ;;
  esac

  download_packages "$PKG_URL_SUFFIX" "$COMMON_PACKAGE_PREFIXES"

  if [[ "$_os" = "windows" ]]; then
    download_packages "$PKG_URL_SUFFIX" "$WIN_ONLY_PACKAGE_PREFIXES"
  fi

  if [[ "$_os" = "linux" ]]; then
    download_packages "${STACK_VERSION}-x86_64.rpm" "$RPM_PACKAGES"
    download_packages "${STACK_VERSION}-amd64.deb" "$DEB_PACKAGES"
  fi
done


## selinux tweaks
# semanage fcontext -a -t "httpd_sys_content_t" '/opt/elastic-packages(/.*)?'
# restorecon -Rv /opt/elastic-packages
	
```

--------------------------------

### Move Generated Certificate to Certs Directory

Source: https://www.elastic.co/guide/en/elastic-stack/current/install-stack-demo-secure.html

After generating the certificate, move the `.p12` file to the Elasticsearch certificates directory.

```bash
sudo mv /usr/share/elasticsearch/elastic-certificates.p12 /etc/elasticsearch/certs/
		
```

--------------------------------

### Rename Existing HTTP Keystore

Source: https://www.elastic.co/guide/en/elastic-stack/current/install-stack-demo-secure.html

Rename the existing http.p12 file to avoid filename collisions on additional nodes.

```bash
mv http.p12 http-old.p12
		
```

--------------------------------

### Generate Kibana Enrollment Token

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

Execute this command on your Elasticsearch node to generate a token specifically for enrolling Kibana. Ensure you use the correct path to the `elasticsearch-create-enrollment-token` script.

```bash
sudo /usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana
		
```

--------------------------------

### Configure HTTP Host for Elasticsearch

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

Ensure `http.host` is configured to `0.0.0.0` to allow HTTP traffic on all network interfaces. Add this setting if it's not present.

```yaml
http.host: 0.0.0.0
		
```

--------------------------------

### Edit Kibana configuration

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

Open the Kibana configuration file for modification.

```bash
sudo vim /etc/kibana/kibana.yml
```

--------------------------------

### Rename existing keystore

Source: https://www.elastic.co/guide/en/elastic-stack/current/install-stack-demo-secure.html

Renames the current http.p12 file to prevent name collisions with the new keystore.

```bash
sudo mv /etc/elasticsearch/certs/http.p12 /etc/elasticsearch/certs/http-old.p12
```

--------------------------------

### Generate SystemD Service File for EPR (Specific Version)

Source: https://www.elastic.co/guide/en/elastic-stack/current/air-gapped-install.html

This script generates a SystemD service file for EPR using a specific version of the Docker image. Replace `<SPECIFIC.VERSION.NUMBER>` with the desired Elastic Stack version.

```bash
#!/usr/bin/env bash

EPR_BIND_ADDRESS="0.0.0.0"
EPR_BIND_PORT="8443"
EPR_TLS_CERT="/etc/elastic/epr/epr.pem"
EPR_TLS_KEY="/etc/elastic/epr/epr-key.pem"
EPR_IMAGE="docker.elastic.co/package-registry/distribution:<SPECIFIC.VERSION.NUMBER>"

podman create \
  --name "elastic-epr" \
  -p "$EPR_BIND_ADDRESS:$EPR_BIND_PORT:$EPR_BIND_PORT" \
  -v "$EPR_TLS_CERT:/etc/ssl/epr.crt:ro" \
  -v "$EPR_TLS_KEY:/etc/ssl/epr.key:ro" \
  -e "EPR_ADDRESS=0.0.0.0:$EPR_BIND_PORT" \
  -e "EPR_TLS_CERT=/etc/ssl/epr.crt" \
  -e "EPR_TLS_KEY=/etc/ssl/epr.key" \
  "$EPR_IMAGE"

## creates service file in the root directory
# podman generate systemd --new --files --name elastic-epr --restart-policy always
		
```

--------------------------------

### Verify package integrity

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

Validate the downloaded RPM file against the checksum to ensure the package is not corrupted.

```bash
sha512sum -c elasticsearch-9.3.3-x86_64.rpm.sha512
```

```text
elasticsearch-9.3.3-x86_64.rpm: OK.
```

--------------------------------

### Unzip certificate archive

Source: https://www.elastic.co/guide/en/elastic-stack/current/install-stack-demo-secure.html

Extracts the generated certificate files from the zip archive.

```bash
sudo unzip -d /usr/share/elasticsearch/ /etc/elasticsearch/certs/elasticsearch-ssl-http.zip
```

--------------------------------

### Check Kibana Service Status

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

Run this command to retrieve detailed information about the Kibana service status. The output will include a URL with a verification code.

```bash
sudo systemctl status kibana
		
```

--------------------------------

### Set Directory Ownership

Source: https://www.elastic.co/guide/en/elastic-stack/current/install-stack-demo-secure.html

Updates ownership of the certificates directory to root:elasticsearch.

```bash
sudo chown -R root:elasticsearch /etc/elasticsearch/certs/
```

--------------------------------

### Generate Kibana Server Certificate

Source: https://www.elastic.co/guide/en/elastic-stack/current/install-stack-demo-secure.html

Use the elasticsearch-certutil utility on an Elasticsearch node to generate a certificate bundle for the Kibana server. Replace placeholders with your Kibana server's DNS name and IP address. The --pem flag ensures output in PEM format.

```bash
sudo /usr/share/elasticsearch/bin/elasticsearch-certutil cert --name kibana-server --ca-cert /etc/elasticsearch/certs/ca/ca.crt --ca-key /etc/elasticsearch/certs/ca/ca.key  --dns <DNS name> --ip <IP address> --pem
```

--------------------------------

### Verify Node Joined Cluster

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

Query the `_cat/nodes` API to confirm that the new node has successfully joined the cluster and is visible alongside other nodes. Replace `$ELASTIC_PASSWORD` as needed.

```bash
sudo curl --cacert /etc/elasticsearch/certs/http_ca.crt -u elastic:$ELASTIC_PASSWORD https://localhost:9200/_cat/nodes?v
```

--------------------------------

### Import CA Certificate into Truststore

Source: https://www.elastic.co/guide/en/elastic-stack/current/install-stack-demo-secure.html

Import the newly created CA certificate into the Elasticsearch truststore using the `keytool` utility. Replace `<password>` with your secure truststore password. This step is crucial for establishing trust within the cluster.

```bash
sudo /usr/share/elasticsearch/jdk/bin/keytool -importcert -trustcacerts -noprompt -keystore /etc/elasticsearch/certs/elastic-stack-ca.p12 -storepass <password> -alias new-ca -file /etc/elasticsearch/certs/ca/ca.crt
		
```

--------------------------------

### Unpack Kibana Certificate Bundle

Source: https://www.elastic.co/guide/en/elastic-stack/current/install-stack-demo-secure.html

Extract the generated Kibana server certificate and key from the downloaded zip archive on the Kibana host machine.

```bash
sudo unzip kibana-cert-bundle.zip
```

--------------------------------

### Configure Transport Host for Cluster Communication

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

Uncomment and set `transport.host` to `0.0.0.0` to allow Elasticsearch to accept connections on all network interfaces, enabling inter-node communication. By default, it listens only on `localhost`.

```yaml
transport.host: 0.0.0.0
		
```

--------------------------------

### Set Kibana server host

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

Configure the network binding address for the Kibana server.

```yaml
server.host: 203.0.113.31
```

--------------------------------

### Download Specific Version Elastic Artifacts Script

Source: https://www.elastic.co/guide/en/elastic-stack/current/air-gapped-install.html

This script downloads Elastic Stack artifacts for a specific version. Replace `<SPECIFIC.VERSION.NUMBER>` with the desired version. Ensure the DOWNLOAD_BASE_DIR environment variable is set.

```bash
#!/usr/bin/env bash
set -o nounset -o errexit -o pipefail

STACK_VERSION=<SPECIFIC.VERSION.NUMBER>
ARTIFACT_DOWNLOADS_BASE_URL=https://artifacts.elastic.co/downloads

DOWNLOAD_BASE_DIR=${DOWNLOAD_BASE_DIR:?"Make sure to set DOWNLOAD_BASE_DIR when running this script"}

COMMON_PACKAGE_PREFIXES="apm-server/apm-server beats/auditbeat/auditbeat beats/elastic-agent/elastic-agent beats/filebeat/filebeat beats/heartbeat/heartbeat beats/metricbeat/metricbeat beats/osquerybeat/osquerybeat beats/packetbeat/packetbeat cloudbeat/cloudbeat endpoint-dev/endpoint-security fleet-server/fleet-server"

WIN_ONLY_PACKAGE_PREFIXES="beats/winlogbeat/winlogbeat"

RPM_PACKAGES="beats/elastic-agent/elastic-agent"
DEB_PACKAGES="beats/elastic-agent/elastic-agent"

function download_packages() {
  local url_suffix="$1"
  local package_prefixes="$2"

  local _url_suffixes="$url_suffix ${url_suffix}.sha512 ${url_suffix}.asc"
  local _pkg_dir=""
  local _dl_url=""

  for _download_prefix in $package_prefixes; do
    for _pkg_url_suffix in $_url_suffixes; do
          _pkg_dir=$(dirname ${DOWNLOAD_BASE_DIR}/${_download_prefix})
          _dl_url="${ARTIFACT_DOWNLOADS_BASE_URL}/${_download_prefix}-${_pkg_url_suffix}"
          (mkdir -p $_pkg_dir && cd $_pkg_dir && curl -O "$_dl_url")
    done
  done
}

# and we download
for _os in linux windows; do
  case "$_os" in
    linux)
      PKG_URL_SUFFIX="${STACK_VERSION}-${_os}-x86_64.tar.gz"
      ;;
    windows)
      PKG_URL_SUFFIX="${STACK_VERSION}-${_os}-x86_64.zip"
      ;;
    *)
      echo "[ERROR] Something happened"
      exit 1
      ;;
  esac

  download_packages "$PKG_URL_SUFFIX" "$COMMON_PACKAGE_PREFIXES"

  if [[ "$_os" = "windows" ]]; then
    download_packages "$PKG_URL_SUFFIX" "$WIN_ONLY_PACKAGE_PREFIXES"
  fi

  if [[ "$_os" = "linux" ]]; then
    download_packages "${STACK_VERSION}-x86_64.rpm" "$RPM_PACKAGES"
    download_packages "${STACK_VERSION}-amd64.deb" "$DEB_PACKAGES"
  fi
done


## selinux tweaks
# semanage fcontext -a -t "httpd_sys_content_t" '/opt/elastic-packages(/.*)?'
	
```

--------------------------------

### List Contents of Elasticsearch Keystore

Source: https://www.elastic.co/guide/en/elastic-stack/current/install-stack-demo-secure.html

View the current entries within the Elasticsearch keystore to identify which passwords need to be updated. This is useful for understanding what secure settings are currently configured.

```bash
sudo /usr/share/elasticsearch/bin/elasticsearch-keystore list
		
```

--------------------------------

### Check Elasticsearch Connectivity

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

Use `curl` to verify that Elasticsearch is running and accessible on `localhost:9200`. Replace `$ELASTIC_PASSWORD` with your actual password.

```bash
sudo curl --cacert /etc/elasticsearch/certs/http_ca.crt -u elastic:$ELASTIC_PASSWORD https://localhost:9200
		
```

--------------------------------

### Generate CA Certificate with elasticsearch-certutil

Source: https://www.elastic.co/guide/en/elastic-stack/current/install-stack-demo-secure.html

Use the `elasticsearch-certutil` utility to generate a new self-signed Certificate Authority (CA) certificate. Specify a unique name for the output zip file when prompted. This command should be run on the first node of your Elasticsearch cluster.

```bash
sudo /usr/share/elasticsearch/bin/elasticsearch-certutil ca -pem
		
```

--------------------------------

### Check Elasticsearch Service Status

Source: https://www.elastic.co/guide/en/elastic-stack/current/install-stack-demo-secure.html

Verify that the Elasticsearch service is running correctly after the restart.

```bash
sudo systemctl status elasticsearch.service
		
```

--------------------------------

### Specify node hostname

Source: https://www.elastic.co/guide/en/elastic-stack/current/install-stack-demo-secure.html

Input the hostname for the Elasticsearch node during the certificate generation process.

```text
mynode-es1
```

--------------------------------

### Check Kibana Service Status

Source: https://www.elastic.co/guide/en/elastic-stack/current/install-stack-demo-secure.html

Verify that the Kibana service is running correctly after the restart. This command displays the current status of the Kibana service.

```bash
sudo systemctl status kibana.service
```

--------------------------------

### Set cluster name

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

Configure the cluster name to match the existing cluster.

```yaml
cluster.name: elasticsearch-demo
```

--------------------------------

### Generate Kibana encryption keys

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

Generate the required encryption keys for Kibana saved objects.

```bash
sudo /usr/share/kibana/bin/kibana-encryption-keys generate
```

--------------------------------

### Update HTTP SSL configuration

Source: https://www.elastic.co/guide/en/elastic-stack/current/install-stack-demo-secure.html

Updates the elasticsearch.yml file to point to the new keystore path.

```yaml
xpack.security.http.ssl:
  enabled: true
  #keystore.path: certs/http.p12
  keystore.path: /etc/elasticsearch/certs/http.p12
```

--------------------------------

### Add HTTP Keystore Password

Source: https://www.elastic.co/guide/en/elastic-stack/current/install-stack-demo-secure.html

Updates the Elasticsearch keystore with the secure password for the HTTP SSL keystore.

```bash
sudo /usr/share/elasticsearch/bin/elasticsearch-keystore add xpack.security.http.ssl.keystore.secure_password
```

--------------------------------

### Configure Transport Layer SSL in elasticsearch.yml

Source: https://www.elastic.co/guide/en/elastic-stack/current/install-stack-demo-secure.html

Update your `elasticsearch.yml` configuration file to point to the newly created keystore and truststore paths for the transport layer SSL.

```yaml
xpack.security.transport.ssl:
   ... 
   keystore.path: /etc/elasticsearch/certs/elastic-certificates.p12
   truststore.path: /etc/elasticsearch/certs/elastic-stack-ca.p12
		
```

--------------------------------

### Configure Elasticsearch discovery seed hosts

Source: https://www.elastic.co/guide/en/elastic-stack/current/installing-stack-demo-self.html

Define master-eligible nodes in the elasticsearch.yml file to ensure proper cluster discovery.

```yaml
discovery.seed_hosts:
  - 203.0.113.21:9300
  - 203.0.113.22:9300
  - 203.0.113.23:9300
```

--------------------------------

### Add New Keystore Passwords

Source: https://www.elastic.co/guide/en/elastic-stack/current/install-stack-demo-secure.html

Add the passwords for the newly created transport keystore and truststore to the Elasticsearch keystore. This allows Elasticsearch to access the updated security files.

```bash
sudo /usr/share/elasticsearch/bin/elasticsearch-keystore add xpack.security.transport.ssl.keystore.secure_password

sudo /usr/share/elasticsearch/bin/elasticsearch-keystore add xpack.security.transport.ssl.truststore.secure_password
		
```

--------------------------------

### Generate New Transport Layer Certificate

Source: https://www.elastic.co/guide/en/elastic-stack/current/install-stack-demo-secure.html

Use this command to generate a new certificate for your Elasticsearch node using the CA certificate and private key. You will be prompted for an output file name and a password.

```bash
sudo /usr/share/elasticsearch/bin/elasticsearch-certutil cert --ca-cert /etc/elasticsearch/certs/ca/ca.crt --ca-key /etc/elasticsearch/certs/ca/ca.key
		
```

--------------------------------

### Set Permissions for Kibana Certificates

Source: https://www.elastic.co/guide/en/elastic-stack/current/install-stack-demo-secure.html

Restrict read access to the Kibana server certificate and key files to the owner and group. This is a security best practice.

```bash
sudo chmod 640 *.crt
sudo chmod 640 *.key
```