How to Install OpenSearch on Rocky Linux 9

OpenSearch is a community-driven project by Amazon and a fork of Elasticsearch and Kibana. It's a fully open-source search engine and analytics suite with rich features and innovative functionality. The OpenSearch project's main component is OpenSearch (a fork of Elasticsearch) and the OpenSearch Dashboards (a fork of Kibana). Both components provide features such as enterprise security, alerting, machine learning, SQL, index state management, and more.

OpenSearch is 100% open-source and licensed under Apache 2.0-licensed. It enables you to easily ingest, secure, search, aggregate, view, and analyze data for a number of use cases such as log analytics, application search, enterprise search, and more.

This article shows you how to install OpenSearch - an open-source search, analytics, and visualization suite - on the Rocky Linux 9 server. This article includes securing OpenSearch deployment with TLS/SSL certificates and setting up authentication and authorization on OpenSearch.

This article also shows you how to install OpenSearch Dashboards - an open-source visualization tool like Kibana, then configure it to connect to OpenSearch. After finished with this article,  you'll have a data analytics and visualization suite installed on your Rocky Linux server.

Prerequisites

To get started with this guide, you must have the following requirements:

• A server with Rocky Linux 9 and minimum RAM 4GB - This example uses a Rocky Linux server with the hostname 'node-rock1', IP address '192.168.5.25', and RAM 8GB.
• A non-root user with sudo/root administrator privileges.
• An SELinux is running in permissive mode.

That's it; Let's start installing OpenSearch.

Setup System

The first thing you must do is prepare your Rocky Linux host. This includes setting up the proper hostname and fqdn, disabling SWAP, and increasing the max maps memory on your system.

To do this, you must log in to your Rocky Linux server.

Now issue the following command to set up the proper hostname and fqdn for your Rocky Linux server.

In this example, you'll set up the system hostname with 'node-rock1' and the fqdn 'node-rock1.hwdomain.lan'. Also, be sure to change the IP address in the following command with your server IP address.

sudo hostnamectl set-hostname node-rock1
echo '192.168.5.25  node-rock1.hwdomain.lan  node-rock1' >> /etc/hosts

Log out of your current session and log in again. Then, verify fqdn via the below command.

sudo hostname -f

You should get an output like this. The fqdn on the host is configured to 'node-rock1.hwdomain.lan'.

Next, you'll need to disable memory paging and SWAP on your Rocky Linux host. Disabling memory paging and SWAP will increase the performance of your OpenSearch server.

Issue the below command to disable SWAP on your system. The first command will disable SWAP permanently by commenting on the SWAP configuration at the '/etc/fstab' file. And the second command is used to disable SWAP on your current session.

sudo sed -i '/ swap / s/^\(.*\)$/#\1/g' /etc/fstab
sudo swapoff -a

Verify the status of SWAP on your system via the following command.

free -m

You'll receive an output similar to this - The 'Swap' section with a value of 0 in total confirms that the SWAP is disabled.

Lastly, you must increase the max maps memory on your system for OpenSearch. And this can be done via the '/etc/sysctl.conf' file.

Issue the following command to increase max maps memory to '262144' and apply the changes. With this, you'll add a new configuration 'vm.max_map_count=262144' to the /etc/sysctl.conf' file and apply the changes on your system via the 'sysctl -p' command.

sudo echo "vm.max_map_count=262144" >> /etc/sysctl.conf
sudo sysctl -p

You can now disable the status of max maps memory on your system with the below command. And you should 'max_map_count' should be increased to '262144'.

cat /proc/sys/vm/max_map_count

Output:

With the system configured, you're ready to install OpenSearch.

Installing OpenSearch

OpenSearch can be installed in multiple ways. You can install OpenSearch via tarball, Docker, RPM, and Kubernetes. For RHEL-based distributions, you can easily be installing OpenSearch via the official OpenSearch repository.

Issue the curl command below to download the OpenSearch repository to your system. Then, verify the list of available repositories via the command below.

sudo curl -SL https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/opensearch-2.x.repo -o /etc/yum.repos.d/opensearch-2.x.repo
sudo dnf repolist

If successful, you should get the repository 'OpenSearch 2.x' available in your terminal output.

You can also check available packages of 'opensearch' by issuing the following command.

sudo dnf info opensearch

At the time of this writing, the OpenSearch repository provides two versions of OpenSearch for different system architectures - OpenSearch 2.5 for x86_64 and aarch64.

Invoke the following dnf command to install OpenSearch on your Rocky Linux server. When prompted for confirmation, input y to confirm and press ENTER to proceed.

sudo dnf install opensearch

Output:

During the installation, you'll also be prompted to add the GPG key for the OpenSearch repository. Input y to confirm and press ENTER.

Once OpenSearch is successfully installed, reload the systemd manager and apply new changes using the below systemctl command utility.

sudo systemctl daemon-reload

Now start and enable OpenSearch using the below command. With this, the OpenSearch should be running with the default configurations and it's also enabled, which means the OpenSearch will start automatically upon the system startup.

sudo systemctl start opensearch
sudo systemctl enable opensearch

To make sure that the OpenSearch is working and running, you can verify using the below systemctl command.

sudo systemctl status opensearch

You should receive an output like this - The output 'active (running)' confirms that the OpenSearch service is running, while '... enabled;...' confirms that the OpenSearch service is enabled.

You have now installed OpenSearch and it's now running and enabled. You can now proceed to the next step for setting up your OpenSearch installation.

Configuring OpenSearch

By default, OpenSearch configurations are stored in the '/etc/opensearch' directory. In this step, you'll do the basic configuration of OpenSearch in a single-node mode. You'll also increase the max heap memory on your system to get better performance of the OpenSearch server.

Open the OpenSearch config file '/etc/opensearch/opensearch.yml' using the below nano editor command.

sudo nano /etc/opensearch/opensearch.yml

Change some default OpenSearch parameters with the following lines. With this, you'll run OpenSearch in a specific network IP address '192.168.5.25', the deployment type is 'single-node', and re-enable the OpenSearch security plugins.

# Bind OpenSearch to the correct network interface. Use 0.0.0.0
# to include all available interfaces or specify an IP address
# assigned to a specific interface.
network.host: 192.168.5.25

# Unless you have already configured a cluster, you should set
# discovery.type to single-node, or the bootstrap checks will
# fail when you try to start the service.
discovery.type: single-node

# If you previously disabled the security plugin in opensearch.yml,
# be sure to re-enable it. Otherwise you can skip this setting.
plugins.security.disabled: false

Save and exit the file '/etc/opensearch/opensearch.yml' when finished.

Next, open the default JVM options file for OpenSearch '/etc/opensearch/jvm.options' using the following nano editor command.

sudo nano /etc/opensearch/jvm.options

Change the default max heap memory with the following lines. This depends on your server memory, you can allocate more like 2GB for OpenSearch if you have bigger RAM memory.

-Xms2g
-Xmx2g

Save the file and exit the editor when finished.

Lastly, run the below systemctl command utility to restart the OpenSearch service and apply the changes.

sudo systemctl restart opensearch

Now the OpenSearch should be running on IP address '192.168.5.25' with the default port '9200'. Verify the list of open ports on your system by issuing the ss command below.

ss -tulpn

Securing OpenSearch with TLS Certificates

In this step, you'll be generating multiple certificates that will be used to secure OpenSearch deployment. You'll secure node-to-node communications with TLS certificates and secure REST-layer traffics between client-server communications via TLS.

Below is the list of certificates that will be generated:

• Root CA certificates: These certificates will be used to sign other certificates.
• Admin certificates: These certificates will be used to get administrative rights to perform all tasks related security plugin.
• Node and Client Certificates: These certificates will be used by nodes and clients within the OpenSearch cluster.

Before generating new TLS certificates, let's remove some default certificates and default OpenSearch configurations.

Issue the following command to remove default OpenSearch TLS certificates. Then, open the OpenSearch configuration '/etc/opensearch/opensearch.yml' using the following nano editor command.

rm -f /opt/opensearch/{esnode-key.pem,esnode.pem,kirk-key.pem,kirk.pem,root-ca.pem}
sudo nano /etc/opensearch/opensearch.yml

At the bottom of the line, comment on the default OpenSearch Security Demo Configuration as below.

Save and exit the file when finished.

Next, issue the following command to create a new directory '/etc/opensearch/certs'. This directory will be used to store new TLS certificates that will be generated. Then, move your working directory into it.

mkdir -p /etc/opensearch/certs; cd /etc/opensearch/certs

Generating Root CA Certificates

Generate a private key for the root CA certificates using the below.

openssl genrsa -out root-ca-key.pem 2048

Now generate a self-signed root CA certificate via the below command. You can also change values within the '-subj' parameter with your information.

openssl req -new -x509 -sha256 -key root-ca-key.pem -subj "/C=CA/ST=ONTARIO/L=TORONTO/O=ORG/OU=UNIT/CN=ROOT" -out root-ca.pem -days 730

With this, you should get the root CA private key 'root-ca-key.pem' and the root CA certificate 'root-ca.pem'.

Output:

Generating Admin Certificates

Generate the new admin certificate private key 'admin-key-temp.pem' using the below command.

openssl genrsa -out admin-key-temp.pem 2048

Convert the default admin private key to PKCS#8 format. For the Java application, you need to convert the default private key to PKCS#12-compatible algorithm (3DES). With this, your admin private key should be 'admin-key.pem'.

openssl pkcs8 -inform PEM -outform PEM -in admin-key-temp.pem -topk8 -nocrypt -v1 PBE-SHA1-3DES -out admin-key.pem

Next, run the below command to generate the admin CSR (Certificate Signing Request) from the 'admin-key.pem' private key. Your generated CSR should now be 'admin.csr' file.

Because this certificate is used for authenticating elevated access and is not tied to any hosts, you can use anything in the 'CN' configuration.

openssl req -new -key admin-key.pem -subj "/C=CA/ST=ONTARIO/L=TORONTO/O=ORG/OU=UNIT/CN=A" -out admin.csr

Lastly, run the below command to sign the admin CSR with the root CA certificate and private key. The output of the admin certificate is the 'admin.pem' file.

openssl x509 -req -in admin.csr -CA root-ca.pem -CAkey root-ca-key.pem -CAcreateserial -sha256 -out admin.pem -days 730

Your admin certificate should now be 'admin.pem' file which is signed with root CA certificates. And the admin private key is 'admin-key.pem', which is converted to PKCS#8 format.

Output:

Generating Node Certificates

The process of generating node certificates is similar to admin certificates. But, you can specify the CN value with the hostname or IP address of your node.

Generate the node private key using the below command.

openssl genrsa -out node-rock1-key-temp.pem 2048

Convert the node private key to PKCS#8 format. Your node private key should now be 'node-rock1-key.pem'.

openssl pkcs8 -inform PEM -outform PEM -in node-rock1-key-temp.pem -topk8 -nocrypt -v1 PBE-SHA1-3DES -out node-rock1-key.pem

Next, create a new CSR for the node certificate. Be sure to change the 'CN' value with the hostname of your node. This certificate is tied to hosts, and you must specify the CN value with the hostname or IP address of your OpenSearch node.

openssl req -new -key node-rock1-key.pem -subj "/C=CA/ST=ONTARIO/L=TORONTO/O=ORG/OU=UNIT/CN=node-rock1.hwdomain.lan" -out node-rock1.csr

Before signing the node certificate, run the below command to create a SAN extension file 'node-rock1.ext'. This will contain the node hostname or FQDN or IP address.

echo 'subjectAltName=DNS:node-rock1.hwdomain.lan' > node-rock1.ext

Lastly, sign the node certificate CSR file with root CA certificate and private using the below command.

openssl x509 -req -in node-rock1.csr -CA root-ca.pem -CAkey root-ca-key.pem -CAcreateserial -sha256 -out node-rock1.pem -days 730 -extfile node-rock1.ext

With this, your node certificate is a 'node-rock1.pem' file and the private key is 'node-rock1-key.pem'.

Output:

Setting up Certificates

Run the below command to remove the temporary certificate, CSR, and SAN extension file.

rm *temp.pem *csr *ext
ls

Convert the root CA certificate to .crt format.

openssl x509 -outform der -in root-ca.pem -out root-ca.crt

Add the root CA certificate to your Rocky Linux system using the below command. Co