# Broke login to kibana **URL:** \ **Category:** Kibana\ **Created:** [December 15, 2022, 5:35pm UTC](https://discuss.elastic.co/t/broke-login-to-kibana/321334 "2022-12-15T17:35:22Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![ant2ne](https://avatars.discourse-cdn.com/v4/letter/a/13edae/32.png) [@ant2ne](https://discuss.elastic.co/u/ant2ne)\ **Post date:** [December 15, 2022, 5:35pm UTC](https://discuss.elastic.co/t/broke-login-to-kibana/321334/1 "2022-12-15T17:35:22Z")
after doing the minimal security configuration ([Built-in users | Elasticsearch Guide [8.5] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/built-in-users.html)) I can no longer log into the kibana webui. the login of the webpage loads, but doesn't accept kibanaadmin and its password (set by "echo "kibanaadmin:`openssl passwd -apr1`" | sudo tee -a /etc/nginx/htpasswd.users" from [How To Install Elasticsearch, Logstash, and Kibana (Elastic Stack) on Ubuntu 20.04 | DigitalOcean](https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elastic-stack-on-ubuntu-20-04#prerequisites)) The webpage replies to my attempt with "Username or password is incorrect. Please try again." I assume the minimal security setup somehow broke kibanaaadmin. But I don't know how, or why, or how to fix it. /var/log/kibana has the following at each login attempt.... ```auto {"type":"log","@timestamp":"2022-12-14T22:19:49+00:00","tags":["info","plugins","security","routes"],"pid":486,"message":"Logging in with provider \"basic\" (basic)"} {"type":"response","@timestamp":"2022-12-14T22:19:49+00:00","tags":[],"pid":486,"method":"post","statusCode":401,"req":{"url":"/internal/security/login","method":"post","headers":{"connection":"upgrade","host":"x.x.x.x","content-length":"175","user-agent":"Mozilla/5.0 (X11; Linux x86_64; rv:107.0) Gecko/20100101 Firefox/107.0","accept":"*/*","accept-language":"en-US,en;q=0.5","accept-encoding":"gzip, deflate","referer":"http://3.133.215.55/login?next=%2F&msg=UNAUTHENTICATED","content-type":"application/json","kbn-version":"7.17.8","origin":"http://x.x.x.x"},"remoteAddress":"127.0.0.1","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:107.0) Gecko/20100101 Firefox/107.0","referer":"http://3.133.215.55/login?next=%2F&msg=UNAUTHENTICATED"},"res":{"statusCode":401,"responseTime":33,"contentLength":277},"message":"POST /internal/security/login 401 33ms - 277.0B"} ``` If I comment out xpack.security.enabled: true then I can log in (with no security) and if I again uncomment it, no login. Advise Please ---
**Author:** ![ant2ne](https://avatars.discourse-cdn.com/v4/letter/a/13edae/32.png) [@ant2ne](https://discuss.elastic.co/u/ant2ne)\ **Post date:** [December 15, 2022, 7:43pm UTC](https://discuss.elastic.co/t/broke-login-to-kibana/321334/2 "2022-12-15T19:43:59Z")
I thought maybe I need to create another user, but I can't create another user (as per [Elasticsearch Create User](https://linuxhint.com/elasticsearch-create-user/)) it says "Start by launching Kibana, then log in. Use the passwords you used when setting up." But this is the exact password that does not work with "xpack.security.enabled: true" I have done a `/usr/share/elasticsearch/bin/elasticsearch-setup-passwords interactive` And I do have the password which I interacted. These users don't log into the web gui either. I have also, just now, tried `echo "kibanaadmin:`openssl passwd -apr1`" | sudo tee -a /etc/nginx/htpasswd.users` to reset this password after all other work I have done. Notta. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [December 15, 2022, 9:53pm UTC](https://discuss.elastic.co/t/broke-login-to-kibana/321334/3 "2022-12-15T21:53:46Z")
Kibana does not use nginx to manage access control on any level, so your use of if here is really only complicating matters more than they need to be. > [@ant2ne](#): > > I have done a > `/usr/share/elasticsearch/bin/elasticsearch-setup-passwords interactive` > And I do have the password which I interacted. These users don't log into the web gui either. Can you try to curl Elasticsearch with one of these? What is the response? ---
**Author:** ![ant2ne](https://avatars.discourse-cdn.com/v4/letter/a/13edae/32.png) [@ant2ne](https://discuss.elastic.co/u/ant2ne)\ **Post date:** [December 15, 2022, 9:58pm UTC](https://discuss.elastic.co/t/broke-login-to-kibana/321334/4 "2022-12-15T21:58:55Z")
Thanks for the reply! I'm pulling out hair here. I don't know what you mean but curl from these users. They don't log into the cli, do they? I think these are just 'service' accounts for communication between the idfferen elk apps in the stack. ```auto sudo su - kibana_system [sudo] password for cygne: su: user kibana_system does not exist or the user entry does not contain all the required fields ``` ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [December 15, 2022, 10:54pm UTC](https://discuss.elastic.co/t/broke-login-to-kibana/321334/5 "2022-12-15T22:54:16Z")
You want to do `curl -u username:password https://ElasticsearchIPorHostname:9200`. ---
**Author:** ![ant2ne](https://avatars.discourse-cdn.com/v4/letter/a/13edae/32.png) [@ant2ne](https://discuss.elastic.co/u/ant2ne)\ **Post date:** [December 16, 2022, 3:10pm UTC](https://discuss.elastic.co/t/broke-login-to-kibana/321334/6 "2022-12-16T15:10:25Z")
UN=kibana\_system PW= HN=127.0.0.1 curl -u $UN:$PW http://:9200$HN {"error":{"root\_cause":[{"type":"security\_exception","reason":"unable to authenticate user [kibana\_system] for REST request [/]","header":{"WWW-Authenticate":"Basic realm="security" charset="UTF-8""}}],"type":"security\_exception","reason":"unable to authenticate user [kibana\_system] for REST request [/]","header":{"WWW-Authenticate":"Basic realm="security" charset="UTF-8""}},"status":401}c This sounds like a bad password. Although, I took good notes. How do I reset this password? It says " After you set a password for the `elastic` user, you cannot run the `elasticsearch-setup-passwords` command a second time." https://www.elastic.co/guide/en/elasticsearch/reference/7.17/security-minimal-setup.html I can't be the first potential fat finger. (actually, I did buy a new keyboard just before this project) ---
**Author:** ![redsearch2022](https://avatars.discourse-cdn.com/v4/letter/r/e9a140/32.png) [@redsearch2022](https://discuss.elastic.co/u/redsearch2022)\ **Post date:** [December 16, 2022, 3:37pm UTC](https://discuss.elastic.co/t/broke-login-to-kibana/321334/7 "2022-12-16T15:37:29Z")
You can try resetting the password elasticsearch-reset-password --username user1 -i > **[elasticsearch-reset-password | Elasticsearch Guide \[8.5\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/reset-password.html)** ---
**Author:** ![ant2ne](https://avatars.discourse-cdn.com/v4/letter/a/13edae/32.png) [@ant2ne](https://discuss.elastic.co/u/ant2ne)\ **Post date:** [December 16, 2022, 4:11pm UTC](https://discuss.elastic.co/t/broke-login-to-kibana/321334/8 "2022-12-16T16:11:26Z")
it does not appear --username is an option. ```auto sudo /usr/share/elasticsearch/bin/elasticsearch-setup-passwords --help warning: usage of JAVA_HOME is deprecated, use ES_JAVA_HOME Sets the passwords for reserved users Commands -------- auto - Uses randomly generated passwords interactive - Uses passwords entered by a user Non-option arguments: command Option Description ------ ----------- -E Configure a setting -h, --help Show help -s, --silent Show minimal output -v, --verbose Show verbose output ``` I don't think it like that -i either. The command specified (in reference above) is `elasticsearch-set-password interactive` (no - / or --) and --help spits out the same as above. Am I looking at a complete re-install? Or can I just reinstall elasticsearch, which seems to be the app that holds the credentials for the others? ---
**Author:** ![redsearch2022](https://avatars.discourse-cdn.com/v4/letter/r/e9a140/32.png) [@redsearch2022](https://discuss.elastic.co/u/redsearch2022)\ **Post date:** [December 16, 2022, 7:58pm UTC](https://discuss.elastic.co/t/broke-login-to-kibana/321334/9 "2022-12-16T19:58:03Z")
> [@redsearch2022](#): > > The command is : elasticsearch-reset-password > you were running `sudo /usr/share/elasticsearch/bin/elasticsearch-setup-passwords` ```auto $ sudo /usr/share/elasticsearch/bin/elasticsearch-reset-password --help Resets the password of users in the native realm and built-in users. Option (* = required) Description --------------------- ----------- -E Configure a setting -a, --auto -b, --batch -f, --force Use this option to force execution of the command against a cluster that is currently unhealthy. -h, --help Show help -i, --interactive -s, --silent Show minimal output * -u, --username The username of the user whose password will be reset --url the URL where the elasticsearch node listens for connections. -v, --verbose Show verbose output ``` ---
**Author:** ![ant2ne](https://avatars.discourse-cdn.com/v4/letter/a/13edae/32.png) [@ant2ne](https://discuss.elastic.co/u/ant2ne)\ **Post date:** [December 16, 2022, 8:29pm UTC](https://discuss.elastic.co/t/broke-login-to-kibana/321334/10 "2022-12-16T20:29:17Z")
ahh tanks. I got it. ```auto root@ip-172-31-19-233:/home# /usr/share/elasticsearch/bin/elasticsearch-setup-passwords auto warning: usage of JAVA_HOME is deprecated, use ES_JAVA_HOME Failed to authenticate user 'elastic' against http://127.0.0.1:9200/_security/_authenticate?pretty Possible causes include: * **The password for the 'elastic' user has already been changed on this cluster** *** Your elasticsearch node is running against a different keystore** This tool used the keystore at /etc/elasticsearch/elasticsearch.keystore ERROR: Failed to verify bootstrap password ``` Is borked? proper borked. ---
**Author:** ![ant2ne](https://avatars.discourse-cdn.com/v4/letter/a/13edae/32.png) [@ant2ne](https://discuss.elastic.co/u/ant2ne)\ **Post date:** [December 18, 2022, 6:43pm UTC](https://discuss.elastic.co/t/broke-login-to-kibana/321334/11 "2022-12-18T18:43:25Z")
If ```auto /usr/share/elasticsearch/bin/elasticsearch-setup-passwords interactive ``` is an option, then I wouldn't know the passwords for those usernames and I would not be able to login at the kibana web gui with one of those usernames. I don't use what was set with htpasswd (kibanaadmin) who/what then, do I use to log into the web interface? ---
**Author:** ![ant2ne](https://avatars.discourse-cdn.com/v4/letter/a/13edae/32.png) [@ant2ne](https://discuss.elastic.co/u/ant2ne)\ **Post date:** [December 19, 2022, 8:12pm UTC](https://discuss.elastic.co/t/broke-login-to-kibana/321334/12 "2022-12-19T20:12:20Z")
i've decided to change gears and drop digitaloceans tutorial and go with [https://www.elastic.co/guide/en/elastic-stack/current/installing-elastic-stack.html](https://www.elastic.co/guide/en/elastic-stack/current/installing-elastic-stack.html) With which, I did get farther, but got stuck again. I will open a new thread for that problem. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 16, 2023, 8:13pm UTC](https://discuss.elastic.co/t/broke-login-to-kibana/321334/13 "2023-01-16T20:13:12Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.