Anonymous access is denied in kibana?

[Shreesh_Narayanan]

Hi Folks,

I have 3 node elasticsearch , 2 logstash nodes and 1 kibana node . Do i mention all three elasticsearch nodes in kibana.yml's "elasticsearch.hosts" config line ? . It was working when i had just the master elastic IP in kibana.yml when the cluster was running in Single-node setup.

Like this ? currently i have assigned all 3 as [Master and DATA nodes]

# This section was automatically generated during setup.
elasticsearch.hosts: ['https://10.27.101.100:9200','https://10.27.101.247:9200','https://10.27.101.63:9200']

this is the log line seen with error

{"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"8.6.0"},"@timestamp":"2023-04-12T06:23:31.000+00:00","message":"Failed to authenticate anonymous service account: {\"error\":{\"root_cause\":[{\"type\":\"security_exception\",\"reason\":\"missing authentication credentials for REST request [/_security/_authenticate]\",\"header\":{\"WWW-Authenticate\":[\"Basic realm=\\\"security\\\" charset=\\\"UTF-8\\\"\",\"Bearer realm=\\\"security\\\"\",\"ApiKey\"]}}],\"type\":\"security_exception\",\"reason\":\"missing authentication credentials for REST request [/_security/_authenticate]\",\"header\":{\"WWW-Authenticate\":[\"Basic realm=\\\"security\\\" charset=\\\"UTF-8\\\"\",\"Bearer realm=\\\"security\\\"\",\"ApiKey\"]}},\"status\":401}","log":{"level":"WARN","logger":"plugins.security.anonymous-access"},"process":{"pid":622225},"trace":{"id":"21a889d32ffef255e517124407d2eaf0"},"transaction":{"id":"feaa6836a00081c3"}}
{"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"8.6.0"},"@timestamp":"2023-04-12T06:23:31.000+00:00","message":"Default capabilities will be returned since anonymous service account cannot authenticate.","log":{"level":"WARN","logger":"plugins.security.anonymous-access"},"process":{"pid":622225},"trace":{"id":"21a889d32ffef255e517124407d2eaf0"},"transaction":{"id":"feaa6836a00081c3"}}

[Shreesh_Narayanan]

Update : is it because kibana can't authenticate to the other elasticsearch nodes ? I had reverted it back to use the original elastic IP (from when it was created as a single node cluster) and anonymous access works . Should i need to create service account token on the newer nodes? (elastic/kibana)

# This section was automatically generated during setup.
#elasticsearch.hosts: ['https://10.27.101.100:9200','https://10.27.101.247:9200','https://10.27.101.63:9200']
elasticsearch.hosts: ['https://10.27.101.63:9200']
elasticsearch.serviceAccountToken: AAEAAWVsYXN0aWMva2liYW5hL2Vucm9sbC1wcm9jZXNzLXRva2VuLTE2NTUxMjgxMzMyNzM6UmtlcTJheUhSbHFPUDhSR2J0MGJYQQ
elasticsearch.ssl.certificateAuthorities: [/var/lib/kibana/ca_1655128134345.crt]
xpack.fleet.outputs: [{id: fleet-default-output, name: default, is_default: true, is_default_monitoring: true, type: elasticsearch, hosts: ['https://10.27.101.63:9200'], ca_trusted_fingerprint: 322f0080ceac8584c4eb81a417853e1a68099201e67ae5992afc4a32f39aed3e}]