# Advice needed on migrating from X-pack

**URL:** <https://discuss.elastic.co/t/advice-needed-on-migrating-from-x-pack/120635>\
**Category:** Elasticsearch\
**Created:** [February 20, 2018, 12:08pm UTC](https://discuss.elastic.co/t/advice-needed-on-migrating-from-x-pack/120635 "2018-02-20T12:08:09Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kannaj](https://avatars.discourse-cdn.com/v4/letter/k/a183cd/32.png) [@Kannaj](https://discuss.elastic.co/u/Kannaj)\
**Post date:** [February 20, 2018, 12:08pm UTC](https://discuss.elastic.co/t/advice-needed-on-migrating-from-x-pack/120635/1 "2018-02-20T12:08:10Z")

</div>

Hello,

We've deployed an elastic cluster using the recommended template in azure ([https://github.com/elastic/azure-marketplace](https://github.com/elastic/azure-marketplace)). Once created , we have 6 nodes (3 master + 3 data nodes) in a virtual network and one VM hosting kibana (this vm is public facing).

However , we want to move away from X-pack and roll out our own security measures (Using Nginx for auth for now and possibly bring in search-guard later).

To that effect , i did the below -

- SSH'd into each VM and performed `/usr/share/{elasticsearch|kibana}/bin/elasticsearch-plugin remove Xpack`

After removing Xpack from both kibana/elasticsearch - i tried accessing the kibana url (xxxx:  
) - but i still see a popup screen asking me for authentication (i can either login by `elastic` user or `es_kibana` user.

 ![image](https://user-images.githubusercontent.com/13432536/36422508-54fa5490-1662-11e8-8c60-b39232f48ee2.png)

What is causing this popup to occur and how do i remove it?

Also , i just wanted to confirm if the process of authenticating using a reverse proxy in front of kibana would be sufficient enough for security (for a POC concept - not at scale) considerations. I will be adding search-guard on top of this later

thanks,  
KJ

---

<div class="post-metadata">

**Author:** ![rjernst](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rjernst/32/6363_2.png) [@rjernst](https://discuss.elastic.co/u/rjernst)\
**Post date:** [February 21, 2018, 9:57pm UTC](https://discuss.elastic.co/t/advice-needed-on-migrating-from-x-pack/120635/2 "2018-02-21T21:57:00Z")

</div>

Did you restart both elasticsearch and kibana? Adding or removing plugins requires restarting.

---

<div class="post-metadata">

**Author:** ![forloop](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/forloop/32/9021_2.png) [@forloop](https://discuss.elastic.co/u/forloop)\
**Post date:** [February 22, 2018, 1:11am UTC](https://discuss.elastic.co/t/advice-needed-on-migrating-from-x-pack/120635/3 "2018-02-22T01:11:54Z")

</div>

@Kannaj The ARM template uses monit to monitor the elasticsearch service, so you would need to stop it using monit, remove the plugin, and start again

```bash
sudo monit stop elasticsearch
/usr/share/elasticsearch/bin/elasticsearch-plugin remove x-pack --purge
sudo monit start elasticsearch

```

If you're deploying Elasticsearch 6.x, you'll also need to remove `bootstrap.password` from [the Elasticsearch keystore](https://www.elastic.co/guide/en/elasticsearch/reference/6.2/secure-settings.html) **_before restarting_**

```bash
/usr/share/elasticsearch/bin/elasticsearch-keystore remove bootstrap.password

```

To remove X-Pack from Kibana

```bash
/usr/share/kibana/bin/kibana-plugin remove x-pack
sudo service kibana restart

```

Instead of removing X-Pack completely, you may be interested in [registering for a **free basic license**](https://register.elastic.co/) and [applying this to the cluster](https://www.elastic.co/guide/en/x-pack/current/installing-license.html). The [free basic license provides a subset of the features of X-Pack](https://www.elastic.co/subscriptions)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 22, 2018, 1:12am UTC](https://discuss.elastic.co/t/advice-needed-on-migrating-from-x-pack/120635/4 "2018-03-22T01:12:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.