# Authentication Clarification for Elasticsearch 6+ **URL:** \ **Category:** Elasticsearch\ **Created:** [March 16, 2018, 5:58pm UTC](https://discuss.elastic.co/t/authentication-clarification-for-elasticsearch-6/124344 "2018-03-16T17:58:20Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Airn5475](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/airn5475/32/13757_2.png) [@Airn5475](https://discuss.elastic.co/u/Airn5475)\ **Post date:** [March 16, 2018, 5:58pm UTC](https://discuss.elastic.co/t/authentication-clarification-for-elasticsearch-6/124344/1 "2018-03-16T17:58:21Z")
I am attempting to upgrade to 6.2.2 from 5.2.1. Thankfully I can just install a clean version, no upgrade. I am using just the **Basic License**. I believe that the basic authentication from version 5 is no longer available. If I understand the documentation correctly, I need to install X-Pack and use the security features therein if I want to secure my stack with a username and password. I have tried to follow the following documentation without success: [https://www.elastic.co/guide/en/x-pack/6.2/security-getting-started.html](https://www.elastic.co/guide/en/x-pack/6.2/security-getting-started.html) [https://www.elastic.co/guide/en/x-pack/6.2/setting-up-authentication.html#set-built-in-user-passwords](https://www.elastic.co/guide/en/x-pack/6.2/setting-up-authentication.html#set-built-in-user-passwords) It has ended with the following error message: ``` Possible causes include: The password for the 'elastic' user has already been changed on this cluster Your elasticsearch node is running against a different keystore This tool used the keystore at C:\Elasticsearch\config\elasticsearch.keystore ``` **My Question:** Can I set up **Basic Authentication** using a **Basic License** of Elasticsearch? I am just looking for Basic Authentication for a Single Node. I do not have multiple users/roles. Thank you! -Aaron ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [March 16, 2018, 6:30pm UTC](https://discuss.elastic.co/t/authentication-clarification-for-elasticsearch-6/124344/2 "2018-03-16T18:30:15Z")
Basic license never had authentication. ---
**Author:** ![Airn5475](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/airn5475/32/13757_2.png) [@Airn5475](https://discuss.elastic.co/u/Airn5475)\ **Post date:** [March 16, 2018, 7:04pm UTC](https://discuss.elastic.co/t/authentication-clarification-for-elasticsearch-6/124344/3 "2018-03-16T19:04:51Z")
Sorry, I feel a bit confused. In our current setup I use 'elastic'/'changeme' to "secure" our stack. Yes, I know, shame on me. Everything I'm reading now for 6+ says there is no longer a default password and you need to install X-Pack and run through `setup-passwords` to create built-in user passwords for elasticsearch, kibana and logstash. (As mentioned, I've tried a couple times without success). Is it possible for me, using a Basic License, to secure my Elasticsearch, Kibana & Logstash using a username and password? ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [March 16, 2018, 7:26pm UTC](https://discuss.elastic.co/t/authentication-clarification-for-elasticsearch-6/124344/4 "2018-03-16T19:26:40Z")
No. A basic license does not include security. Have a look at [https://www.elastic.co/subscriptions](https://www.elastic.co/subscriptions) ---
**Author:** ![Airn5475](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/airn5475/32/13757_2.png) [@Airn5475](https://discuss.elastic.co/u/Airn5475)\ **Post date:** [March 16, 2018, 7:48pm UTC](https://discuss.elastic.co/t/authentication-clarification-for-elasticsearch-6/124344/5 "2018-03-16T19:48:20Z")
So now I'm questioning my sanity. Obviously I'm still an ES rookie. When I originally set up Elasticsearch, did it perhaps ask for a Username & Password since it was on a Trial license. Once the trial license ran out and I got a Basic License, I must have continued submitting the username and password with my requests even though they aren't required and just never noticed. Thankfully our stack lives behind the firewall with no external access. So just to be clear, if I am going to install X-Pack for monitoring with a Basic License and thus not have security, do I need to disable security in the elasticsearch, kibana and logstash `.yml` files? Using this setting: `xpack.security.enabled: false` Or does it not matter? ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [March 16, 2018, 8:01pm UTC](https://discuss.elastic.co/t/authentication-clarification-for-elasticsearch-6/124344/6 "2018-03-16T20:01:53Z")
I think that as soon you enter the basic license it disables security so you don't have to do it explicitly. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [March 17, 2018, 12:10am UTC](https://discuss.elastic.co/t/authentication-clarification-for-elasticsearch-6/124344/7 "2018-03-17T00:10:26Z")
> [@Airn5475](#): > > do I need to disable security in the elasticsearch, kibana and logstash .yml files? > > Using this setting: xpack.security.enabled: false You don't have to, but it can be helpful. If you don't explicitly disable security, then X-Pack will start with security enabled, form a cluster, and then detect that the cluster has a basic license, and turn the security features off. We need to do this, as the license is a cluster setting and an individual node does not know what licence type is in use until it gets the cluster state from the active master. But that means that security is active until your node joins a cluster, which can make it difficult to monitor a node that is still looking for a cluster. Explicitly disabling security avoids that minor issue. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 14, 2018, 12:10am UTC](https://discuss.elastic.co/t/authentication-clarification-for-elasticsearch-6/124344/8 "2018-04-14T00:10:54Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.