# Catch 22 with creating passwords **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [March 25, 2021, 9:50pm UTC](https://discuss.elastic.co/t/catch-22-with-creating-passwords/268416 "2021-03-25T21:50:37Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![ricwhitney](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ricwhitney/32/43043_2.png) [@ricwhitney](https://discuss.elastic.co/u/ricwhitney)\ **Post date:** [March 25, 2021, 9:50pm UTC](https://discuss.elastic.co/t/catch-22-with-creating-passwords/268416/1 "2021-03-25T21:50:37Z")
Running Elastic 7.12 Basic (I assume) I'm stuck in a Catch 22 - when I enable x-pack security I cannot connect to elastic for setting passwords. When I disable x-pack security, and go to set passwords, it tells me security is not enabled on this system when I do this: #xpack.security.enabled: true #xpack.security.transport.ssl.enabled: true I can run elastic without authentication but I want/need to run in secure mode if I enable or uncomment the above and run bin/elasticsearch-setup-passwords interactive, it says it cannot connect to elastic can anyone assist me on this? Thanks! ---
**Author:** ![AClerk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aclerk/32/55297_2.png) [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Post date:** [March 25, 2021, 10:08pm UTC](https://discuss.elastic.co/t/catch-22-with-creating-passwords/268416/2 "2021-03-25T22:08:32Z")
Hi You need to set up built-in users passwords > **[Built-in users | Elasticsearch Reference \[7.12\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/built-in-users.html#set-built-in-user-passwords)** ---
**Author:** ![AClerk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aclerk/32/55297_2.png) [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Post date:** [March 25, 2021, 10:13pm UTC](https://discuss.elastic.co/t/catch-22-with-creating-passwords/268416/4 "2021-03-25T22:13:48Z")
The **default username** is **elastic** and **password** is changeme . You can check if authentication is enabled by running the same command you ran to check if **Elasticsearch** is working. ---
**Author:** ![ricwhitney](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ricwhitney/32/43043_2.png) [@ricwhitney](https://discuss.elastic.co/u/ricwhitney)\ **Post date:** [March 25, 2021, 10:18pm UTC](https://discuss.elastic.co/t/catch-22-with-creating-passwords/268416/5 "2021-03-25T22:18:25Z")
If I set xpack.security.enabled: true - I cannot use my cluster If I set xpack.security.enabled: false - I cannot set any passwords To tell you the truth. I have not even gotten into how to use authenticated users yet so what's the command for testing if elastic is running while xpack is enabled? ---
**Author:** ![AClerk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aclerk/32/55297_2.png) [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Post date:** [March 25, 2021, 10:20pm UTC](https://discuss.elastic.co/t/catch-22-with-creating-passwords/268416/6 "2021-03-25T22:20:15Z")
enable xpack and login with elastic:changeme. Did it work? ---
**Author:** ![ricwhitney](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ricwhitney/32/43043_2.png) [@ricwhitney](https://discuss.elastic.co/u/ricwhitney)\ **Post date:** [March 25, 2021, 10:30pm UTC](https://discuss.elastic.co/t/catch-22-with-creating-passwords/268416/7 "2021-03-25T22:30:23Z")
also, In order to successfully start elastic with xpack security enabled, I needed to add xpack.security.transport.ssl.enabled: true could it be that I MUST have an ssl cert in place in order to connect to elastic? ---
**Author:** ![ricwhitney](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ricwhitney/32/43043_2.png) [@ricwhitney](https://discuss.elastic.co/u/ricwhitney)\ **Post date:** [March 25, 2021, 10:30pm UTC](https://discuss.elastic.co/t/catch-22-with-creating-passwords/268416/8 "2021-03-25T22:30:48Z")
How do I get prompted for a login? ---
**Author:** ![ricwhitney](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ricwhitney/32/43043_2.png) [@ricwhitney](https://discuss.elastic.co/u/ricwhitney)\ **Post date:** [March 25, 2021, 10:35pm UTC](https://discuss.elastic.co/t/catch-22-with-creating-passwords/268416/9 "2021-03-25T22:35:18Z")
I just tried to load the url for Kibana and get: ```auto {"statusCode":401,"error":"Unauthorized","message":"missing authentication credentials for REST request [/.kibana_7.12.0/_search?from=0&rest_total_hits_as_int=true&size=1000]: security_exception"} ``` with xpack enabled Thank you for your help BTW! ---
**Author:** ![AClerk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aclerk/32/55297_2.png) [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Post date:** [March 25, 2021, 10:44pm UTC](https://discuss.elastic.co/t/catch-22-with-creating-passwords/268416/10 "2021-03-25T22:44:05Z")
I suggest you start from the beginning. > **[Secure a cluster | Elasticsearch Reference \[7.12\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/secure-cluster.html)** This is my setting for x-pack (in dev machine) ```auto discovery.type: single-node xpack.security.enabled: true xpack.security.transport.ssl.enabled: true xpack.security.transport.ssl.verification_mode: full xpack.security.transport.ssl.keystore.path: /etc/elasticsearch/certs/DEV00V01.p12 xpack.security.transport.ssl.truststore.path: /etc/elasticsearch/certs/DEV00V01.p12 ``` Not sure what's going on with your settings. ---
**Author:** ![ricwhitney](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ricwhitney/32/43043_2.png) [@ricwhitney](https://discuss.elastic.co/u/ricwhitney)\ **Post date:** [March 25, 2021, 10:47pm UTC](https://discuss.elastic.co/t/catch-22-with-creating-passwords/268416/11 "2021-03-25T22:47:55Z")
I have the second 2 lines of your config and this: discovery.zen.ping.unicast.hosts: ["192.168.0.4", "192.168.0.2", "192.168.0.3"] ---
**Author:** ![AClerk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aclerk/32/55297_2.png) [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Post date:** [March 25, 2021, 10:56pm UTC](https://discuss.elastic.co/t/catch-22-with-creating-passwords/268416/12 "2021-03-25T22:56:34Z")
ssl enabled if you want secure login to kibana. i.e http **s** ---
**Author:** ![ricwhitney](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ricwhitney/32/43043_2.png) [@ricwhitney](https://discuss.elastic.co/u/ricwhitney)\ **Post date:** [March 25, 2021, 11:00pm UTC](https://discuss.elastic.co/t/catch-22-with-creating-passwords/268416/13 "2021-03-25T23:00:15Z")
yes I have ssl enabled, but no cert yet ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [March 25, 2021, 11:26pm UTC](https://discuss.elastic.co/t/catch-22-with-creating-passwords/268416/14 "2021-03-25T23:26:29Z")
@ricwhitney [Here](https://github.com/bvader/howtos/blob/master/basic-security-elasticsearch/README.md) is a step by step through that I wrote for a single secured Elasticsearch node with Kibana. It has worked for others. I am not sure what configuration state you are in, but I would probably start over. ---
**Author:** ![ricwhitney](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ricwhitney/32/43043_2.png) [@ricwhitney](https://discuss.elastic.co/u/ricwhitney)\ **Post date:** [March 25, 2021, 11:28pm UTC](https://discuss.elastic.co/t/catch-22-with-creating-passwords/268416/15 "2021-03-25T23:28:43Z")
I'll take a Look at your guide. I just started this morning I had a successful cluster running yesterday (and can again by commenting the xpack stuff) 1 master node and two data nodes ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [March 25, 2021, 11:34pm UTC](https://discuss.elastic.co/t/catch-22-with-creating-passwords/268416/16 "2021-03-25T23:34:10Z")
Just be carefull as you are not running single node. Don't add this. ```auto # Add the rest of these settings at the bottom of the file discovery.type: single-node ``` ---
**Author:** ![ricwhitney](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ricwhitney/32/43043_2.png) [@ricwhitney](https://discuss.elastic.co/u/ricwhitney)\ **Post date:** [March 25, 2021, 11:35pm UTC](https://discuss.elastic.co/t/catch-22-with-creating-passwords/268416/17 "2021-03-25T23:35:27Z")
Thanks, I figured I should not ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [March 25, 2021, 11:38pm UTC](https://discuss.elastic.co/t/catch-22-with-creating-passwords/268416/18 "2021-03-25T23:38:08Z")
> [@ricwhitney](#): > > could it be that I MUST have an ssl cert in place in order to connect to elastic? Also did you see [this](https://www.elastic.co/guide/en/elasticsearch/reference/7.11/trb-security-setup.html)? Trouble with the setup-password command. I am not sure which error you were getting. Yes I would set up all the certs etc before you try to run the setup-passwords command... My walk through should have the correct "Meta Process" you will just need to make sure you do it all correct on all 3 nodes. setup-passwords is only run once though (in case that was not clear) ---
**Author:** ![ricwhitney](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ricwhitney/32/43043_2.png) [@ricwhitney](https://discuss.elastic.co/u/ricwhitney)\ **Post date:** [March 26, 2021, 3:36pm UTC](https://discuss.elastic.co/t/catch-22-with-creating-passwords/268416/19 "2021-03-26T15:36:40Z")
> [@stephenb](#): > > setup-passwords is only run once though (in case that was not clear) setup-passwords only once - on the master only? or once each on the three servers? ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [March 26, 2021, 3:54pm UTC](https://discuss.elastic.co/t/catch-22-with-creating-passwords/268416/20 "2021-03-26T15:54:59Z")
Once for the cluster.... Assuming you have a fully formed cluster. On the master should be fine. BTW 1 master + 2 Data ... Me I would do 3 Master / Data... more resilient, that is just my perspective. ---
**Author:** ![ricwhitney](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ricwhitney/32/43043_2.png) [@ricwhitney](https://discuss.elastic.co/u/ricwhitney)\ **Post date:** [March 26, 2021, 7:47pm UTC](https://discuss.elastic.co/t/catch-22-with-creating-passwords/268416/21 "2021-03-26T19:47:59Z")
Thank you and Thanks for the perspective [Next page](https://discuss.elastic.co/t/catch-22-with-creating-passwords/268416.md?page=2)