# Authentication of \[elastic\] was terminated by realm \[reserved\] - failed to authenticate user \[elastic\]

**URL:** <https://discuss.elastic.co/t/authentication-of-elastic-was-terminated-by-realm-reserved-failed-to-authenticate-user-elastic/336330>\
**Category:** Kibana\
**Created:** [June 19, 2023, 6:52am UTC](https://discuss.elastic.co/t/authentication-of-elastic-was-terminated-by-realm-reserved-failed-to-authenticate-user-elastic/336330 "2023-06-19T06:52:09Z")\
**Posts on this page:** 1\
**Showing post:** 6

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [June 21, 2023, 2:09pm UTC](https://discuss.elastic.co/t/authentication-of-elastic-was-terminated-by-realm-reserved-failed-to-authenticate-user-elastic/336330/6 "2023-06-21T14:09:53Z")

</div>

> [@aaronlbk](#):
>
> elasticsearch.yml

Hi @aaronlbk

Something does not make sense you have an empty elasticsearch.yml yet you have authentication enabled ... that is not normal / highly unusual (basically not sure how that is even possible)

Are you sure that is the elasticsearch.yml that is being used?

How did you install elasticsearch? is this an upgrade from 7.x?

> [@aaronlbk](#):
>
> ```auto
> [2023-06-21T07:59:21,695][INFO][o.e.x.s.a.RealmsAuthenticator] [XXXXX] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]
> [2023-06-21T08:00:08,011][INFO][o.e.x.s.a.RealmsAuthenticator] [XXXXX] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]
> 
> ```

Normally you would turn on Audit logging but that requires a License.

Something is definitely attempting to authenticate...

You might be able to see which process by using something like the following since it looks like elasticsearch is only bound to localhost/127.0.0.1

`lsof -nPi tcp:9200`

Example on my localhost in this case I can see `filebeat` is connecting, you might need to run it more than once.

```auto
$ lsof -nPi tcp:9200
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
filebeat 3424 sbrown 14u IPv4 0x62479b09038ccbd9 0t0 TCP 127.0.0.1:64616->127.0.0.1:9200 (ESTABLISHED)
com.docke 28413 sbrown 169u IPv6 0x62479b0904e04771 0t0 TCP *:9200 (LISTEN)
com.docke 28413 sbrown 231u IPv6 0x62479b0901835771 0t0 TCP 127.0.0.1:9200->127.0.0.1:64616 (ESTABLISHED)

```

---

_[View the full topic](https://discuss.elastic.co/t/authentication-of-elastic-was-terminated-by-realm-reserved-failed-to-authenticate-user-elastic/336330)._