# After X-pack Installation : Failed to authenticate user \[elastic\]

**URL:** <https://discuss.elastic.co/t/after-x-pack-installation-failed-to-authenticate-user-elastic/224416>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [March 20, 2020, 12:04pm UTC](https://discuss.elastic.co/t/after-x-pack-installation-failed-to-authenticate-user-elastic/224416 "2020-03-20T12:04:46Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Moritz\_Kiesewetter](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/moritz_kiesewetter/32/51243_2.png) [@Moritz\_Kiesewetter](https://discuss.elastic.co/u/Moritz_Kiesewetter)\
**Post date:** [March 20, 2020, 12:04pm UTC](https://discuss.elastic.co/t/after-x-pack-installation-failed-to-authenticate-user-elastic/224416/1 "2020-03-20T12:04:46Z")

</div>

Hello Guys,  
as i wanted to implement security in my Cluster, i followed along [This Guide](https://www.elastic.co/guide/en/elasticsearch/reference/current/configuring-security.html) - an it all went well until

> Step 6. Set the passwords for all built-in users.

When i try to execute the command:

> bin/elasticsearch-setup-passwords interactive

I get the following Error:

```
Failed to authenticate user 'elastic' against http://X.X.X.X:9200/_security/_authenticate?pretty
Possible causes include:
 * The password for the 'elastic' user has already been changed on this cluster
 * Your elasticsearch node is running against a different keystore
   This tool used the keystore at /etc/elasticsearch/elasticsearch.keystore

ERROR: Failed to verify bootstrap password

```

I know that the bootstrap password was set by my predecessor - i also have access to it - but still i don't know what i have to do here..  
When i look into the elasticsearch Logs i see the following line:

> [2020-03-20T12:49:02,575][INFO][o.e.x.s.a.AuthenticationService] [_Hostname_] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]

The only configuration i have in my elasticsearch.yml file regarding xpack are the following:

```
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: /elkdata/certs/elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: /elkdata/certs/elastic-certificates.p12

```

Does anyone know what i have to do?

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [March 20, 2020, 12:20pm UTC](https://discuss.elastic.co/t/after-x-pack-installation-failed-to-authenticate-user-elastic/224416/2 "2020-03-20T12:20:17Z")

</div>

> [@Moritz\_Kiesewetter](#):
>
> I know that the bootstrap password was set by my predecessor - i also have access to it - but still i don't know what i have to do here..

`bin/elasticsearch-setup-passwords` is a convenient CLI tool to assist you with setting the password for the built in users. If you have changed the `bootstrap.password` then you can't use the tool, but you can very well use the [Change Password API](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-change-password.html) while authenticating as `elastic` with the password that you have to set the password for the rest of the built-in users, and potential change the password for the `elastic` user itself.

---

<div class="post-metadata">

**Author:** ![Moritz\_Kiesewetter](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/moritz_kiesewetter/32/51243_2.png) [@Moritz\_Kiesewetter](https://discuss.elastic.co/u/Moritz_Kiesewetter)\
**Post date:** [March 20, 2020, 12:32pm UTC](https://discuss.elastic.co/t/after-x-pack-installation-failed-to-authenticate-user-elastic/224416/3 "2020-03-20T12:32:08Z")

</div>

Hello ikakavas!  
Thanks for the fast reply 🙂  
My problem is that i'm in a testing environment, so there's no "Active" Kibana-WebInterface - can i do the API Password Changes via CLI? Or is that a problem?

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [March 20, 2020, 1:50pm UTC](https://discuss.elastic.co/t/after-x-pack-installation-failed-to-authenticate-user-elastic/224416/4 "2020-03-20T13:50:49Z")

</div>

Elasticsearch's APIs do not require the use of Kibana. Check the `Copy as CURL` button in the examples in the documentation I linked to above

---

<div class="post-metadata">

**Author:** ![Moritz\_Kiesewetter](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/moritz_kiesewetter/32/51243_2.png) [@Moritz\_Kiesewetter](https://discuss.elastic.co/u/Moritz_Kiesewetter)\
**Post date:** [March 20, 2020, 2:26pm UTC](https://discuss.elastic.co/t/after-x-pack-installation-failed-to-authenticate-user-elastic/224416/5 "2020-03-20T14:26:32Z")

</div>

Hey,  
i've tried doing it that way - but it keeps telling me that the password is not correct so i did the following:

`bin/elasticsearch-users useradd my_admin -p *Password* -r superuser`

Then i restarded the elasticsearch-service - but even now with a new superuser if i do the REST-Request i get the following error:

```
 curl -u admin -XPUT 'X.X.X.X:9200/_xpack/security/user/elastic/_password?pretty' -H 'Content-Type: application/json' -d'
> {
> "password" : " ******************"
> }
> '
Enter host password for user 'admin':
{
  "error" : {
    "root_cause" : [
      {
        "type" : "security_exception",
        "reason" : "unable to authenticate user [admin] for REST request [/_xpack/security/user/elastic/_password?pretty]",
        "header" : {
          "WWW-Authenticate" : "Basic realm=\"security\" charset=\"UTF-8\""
        }
      }
    ],
    "type" : "security_exception",
    "reason" : "unable to authenticate user [admin] for REST request [/_xpack/security/user/elastic/_password?pretty]",
    "header" : {
      "WWW-Authenticate" : "Basic realm=\"security\" charset=\"UTF-8\""
    }
  },
  "status" : 401

```

If i check if the user correctly listed :

> bin/elasticsearch-users list  
> admin : superuser

Any ideas?

---

<div class="post-metadata">

**Author:** ![Moritz\_Kiesewetter](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/moritz_kiesewetter/32/51243_2.png) [@Moritz\_Kiesewetter](https://discuss.elastic.co/u/Moritz_Kiesewetter)\
**Post date:** [March 20, 2020, 2:51pm UTC](https://discuss.elastic.co/t/after-x-pack-installation-failed-to-authenticate-user-elastic/224416/6 "2020-03-20T14:51:27Z")

</div>

Somehow it told me in the logs that it finally loaded ".security\_7"

Now everything works just fine 🙂  
Thanks!

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [March 20, 2020, 2:58pm UTC](https://discuss.elastic.co/t/after-x-pack-installation-failed-to-authenticate-user-elastic/224416/7 "2020-03-20T14:58:10Z")

</div>

> [@Moritz\_Kiesewetter](#):
>
> bin/elasticsearch-users

adds users to the file realm. The file realm is not enabled by default, you need to [enable it](https://www.elastic.co/guide/en/elasticsearch/reference/7.6/file-realm.html#file-realm-configuration), then you could have used your `admin` user.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 17, 2020, 2:58pm UTC](https://discuss.elastic.co/t/after-x-pack-installation-failed-to-authenticate-user-elastic/224416/8 "2020-04-17T14:58:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.