# Build-in users' passwords gone after service restart **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [July 5, 2021, 5:16pm UTC](https://discuss.elastic.co/t/build-in-users-passwords-gone-after-service-restart/277870 "2021-07-05T17:16:49Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![manfred](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/manfred/32/77079_2.png) [@manfred](https://discuss.elastic.co/u/manfred)\ **Post date:** [July 5, 2021, 5:16pm UTC](https://discuss.elastic.co/t/build-in-users-passwords-gone-after-service-restart/277870/1 "2021-07-05T17:16:49Z")
Hi, ELK 7.13.2, ```auto ./elasticsearch-setup-passwords interactive curl -u elastic 'https://localhost:9200/_xpack/security/_authenticate?pretty' // here authentication as elastic works systemctl restart elasticsearch // after service restart, authentication as elastic doesn't work anymore (and the same for other users, including kibana_system for example) curl -u elastic 'https://localhost:9200/_xpack/security/_authenticate?pretty' ``` any ideas ? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [July 6, 2021, 1:25am UTC](https://discuss.elastic.co/t/build-in-users-passwords-gone-after-service-restart/277870/2 "2021-07-06T01:25:16Z")
Are you running in docker? ---
**Author:** ![manfred](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/manfred/32/77079_2.png) [@manfred](https://discuss.elastic.co/u/manfred)\ **Post date:** [July 6, 2021, 6:55am UTC](https://discuss.elastic.co/t/build-in-users-passwords-gone-after-service-restart/277870/3 "2021-07-06T06:55:26Z")
not docker, but running in Proxmox container Ubuntu 20.04 ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 6, 2021, 7:06am UTC](https://discuss.elastic.co/t/build-in-users-passwords-gone-after-service-restart/277870/4 "2021-07-06T07:06:44Z")
Do you have persistent storage that survives a restart for your Elasticsearch data path? ---
**Author:** ![manfred](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/manfred/32/77079_2.png) [@manfred](https://discuss.elastic.co/u/manfred)\ **Post date:** [July 6, 2021, 7:11am UTC](https://discuss.elastic.co/t/build-in-users-passwords-gone-after-service-restart/277870/5 "2021-07-06T07:11:19Z")
now it's set to /var/lib/elasticsearch and yes it should survive normally, at least I don't see why it shouldn't. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 6, 2021, 7:17am UTC](https://discuss.elastic.co/t/build-in-users-passwords-gone-after-service-restart/277870/6 "2021-07-06T07:17:15Z")
Please create a new index and verify that it was correctly created. Then restart the service/container (you probably want to test both top verify you will not lose data) and verify it is still there. ---
**Author:** ![manfred](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/manfred/32/77079_2.png) [@manfred](https://discuss.elastic.co/u/manfred)\ **Post date:** [July 6, 2021, 7:35am UTC](https://discuss.elastic.co/t/build-in-users-passwords-gone-after-service-restart/277870/7 "2021-07-06T07:35:56Z")
thanks. but now my one node cluster is broken. actually I was following one article to restore my cluster snapshot and I deleted all indices, that's maybe why now all this happens. so I need first to restore the working state of the cluster... ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 6, 2021, 7:39am UTC](https://discuss.elastic.co/t/build-in-users-passwords-gone-after-service-restart/277870/8 "2021-07-06T07:39:13Z")
Be careful to not delete system indices as they hold important data. ---
**Author:** ![manfred](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/manfred/32/77079_2.png) [@manfred](https://discuss.elastic.co/u/manfred)\ **Post date:** [July 6, 2021, 8:38am UTC](https://discuss.elastic.co/t/build-in-users-passwords-gone-after-service-restart/277870/9 "2021-07-06T08:38:28Z")
According to the docs here [Snapshot and restore | Elasticsearch Guide [7.13] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/snapshot-restore.html) You can restore snapshots to a running cluster, which includes all data streams and indices in the snapshot by default. This means that even system indices must be restored. Because now I'm not sure if I can restore my snapshot after when all indices are deleted. ---
**Author:** ![manfred](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/manfred/32/77079_2.png) [@manfred](https://discuss.elastic.co/u/manfred)\ **Post date:** [July 6, 2021, 8:46am UTC](https://discuss.elastic.co/t/build-in-users-passwords-gone-after-service-restart/277870/10 "2021-07-06T08:46:26Z")
ok found this similar issue [Accidentally deleted all indices from the cluster. How do I restore the data? - #7 by TimV](https://discuss.elastic.co/t/accidentally-deleted-all-indices-from-the-cluster-how-do-i-restore-the-data/148806/7) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 3, 2021, 8:47am UTC](https://discuss.elastic.co/t/build-in-users-passwords-gone-after-service-restart/277870/11 "2021-08-03T08:47:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.