Administration Guides
Cluster Administration - UI Access and Security Configuration
Home
Cluster Administration and Operations tools are available using special URL's available on node 1 ip address of the cluster. These WebUI's are secured with a password configured during deployment. This section also covers how to change passwords on admin tool UI and change the self signed cert on the webUI to a signed certificate.
URL to Access Admin UI's
- Solr index engine - allows index health status, document count, index size, error messages, advanced queries for administrators only.
- https://x.x.x.x/solr
- https://x.x.x.x/solr
- Kafka Message processing - used to process file ingestions for full and incremental jobs. HA features and cluster wide view of processing of messages.
- https://x.x.x.x/kafka-manager
- https://x.x.x.x/kafka-manager
- How to Access
- Access the URL enter the user "ecaadmin" and the password that was configured during deployment.
How to add a signed cert to user login GUI
Best Practice:
- Access the WebUI from node 1 and create a DNS entry for node to create a FQDN to create a signed cert.
- The objective is to install the signed cert for nginx ECA Node-1
- Create A record in DNS name for ECA Node-1 and verify with nslookup.. Example eca1.domain.com
- SSH to ECA Node-1 as ecaadmin
- cd /opt/superna/eca/conf/nginx
- Verify that the nginx.key is there with ls -la
- Create csr with that key file
- Command: openssl req -key nginx.key -new -out nginx.csr
- SCP the nginx.csr file for signing
- Or type cat nginx.csr and copy and paste the text to submit for signing.
- When it is asked about the Common Name: provide the fqdn of ECA Node-1 (the name registered in DNS e.g. search.domain.com)
- With that CSR certificate submit the request to Certificate Authority at your enterprise
- NOTE: These steps are CA specific, consult with your security team
- Once received the signed certificate encoded in PEM format
- scp (use WinSCP for WIndows) and copy this file to ECA-1 under /opt/superna/eca/conf/nginx with name nginx.crt
- NOTE: if not in PEM format, convert to PEM format or ask your Security team for pem format
- Replace existing nginx.crt certificate with this new signed CA certificate.
- mv nginx.crt nginx.crt.bak (backup old file)
- cp /pathtonewfile/nginx.crt to /opt/superna/eca/conf/nginx/nginx.crt
- Restart nginx
- ecactl containers stop nginx
- ecactl containers start nginx
- Or bring down and up the ECA cluster to push the config to all the other ECA nodes
- ecactl cluster down
- ecactl cluster up
- Verify the certificate when accessing the UI (e.g. https://FQDN)