# Creating processor \[set\_security\_user\] (tag \[null\]) on field \[\_security\] but authentication is not currently enabled
**URL:** https://discuss.elastic.co/t/creating-processor-set-security-user-tag-null-on-field-security-but-authentication-is-not-currently-enabled/306706
**Category:** SIEM
**Tags:** elastic-stack-security
**Created:** [June 8, 2022, 2:05pm UTC](https://discuss.elastic.co/t/creating-processor-set-security-user-tag-null-on-field-security-but-authentication-is-not-currently-enabled/306706 "2022-06-08T14:05:00Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@K\_st\_rs](https://discuss.elastic.co/u/K_st_rs)
#### Post date: [June 8, 2022, 2:05pm UTC](https://discuss.elastic.co/t/creating-processor-set-security-user-tag-null-on-field-security-but-authentication-is-not-currently-enabled/306706/1 "2022-06-08T14:05:00Z")
Logs are filled every 4 minutes with below message on a test server and there is no help on this. I am fairly new to this and wouldn't have edited any files to a big extent. There is another thread on here ([discuss.elastic.co](http://discuss.elastic.co)) that is closed that got the same warn, but had no successful conclusion.
`Creating processor [set_security_user] (tag [null]) on field [_security] but authentication is not currently enabled on this cluster - this processor is likely to fail at runtime if it is used`
---
### Author:  [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)
#### Post date: [June 9, 2022, 1:38am UTC](https://discuss.elastic.co/t/creating-processor-set-security-user-tag-null-on-field-security-but-authentication-is-not-currently-enabled/306706/2 "2022-06-09T01:38:32Z")
My recommendation is to enable security for you cluster. Security is a free feature. It is [automatically enabled](https://www.elastic.co/guide/en/elasticsearch/reference/8.2/configuring-stack-security.html) with v8.0 or higher. Or you can [manually configured](https://www.elastic.co/guide/en/elasticsearch/reference/8.2/manually-configure-security.html) it for previous versions.
---
### Author:  [@K\_st\_rs](https://discuss.elastic.co/u/K_st_rs)
#### Post date: [June 18, 2022, 2:19pm UTC](https://discuss.elastic.co/t/creating-processor-set-security-user-tag-null-on-field-security-but-authentication-is-not-currently-enabled/306706/3 "2022-06-18T14:19:50Z")
The documentation is largely not working for me as far as I can see:
run the [`elasticsearch-reset-password`](https://www.elastic.co/guide/en/elasticsearch/reference/8.2/reset-password.html) tool.
OK I can get a password, but what do I do then?
```auto
bin/elasticsearch-create-enrollment-token -s kibana --url "https://127.0.0.1:9200"
ERROR: [xpack.security.enrollment.enabled] must be set to `true` to create an enrollment token
```
Do I enter this in elasticsearch.yml
```auto
bin/elasticsearch-create-enrollment-token -s kibana --url "https://127.0.0.1:9200"
ERROR: Failed to determine the health of the cluster.
```
Do I try the other thing suggested on
```auto
bin/elasticsearch-create-enrollment-token -s node
Unable to create enrollment token for scope [node]
ERROR: Unable to create an enrollment token. Elasticsearch node HTTP layer SSL configuration is not configured with a keystore
```
```auto
bin/elasticsearch-create-enrollment-token -s kibana
Unable to create enrollment token for scope [kibana]
```
then it claims somewhere I have a cert directory in /etc/elasticsearch
I don't have that directory.
Do I generate ca or http
> **[elasticsearch-certutil | Elasticsearch Guide \[8.2\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/8.2/certutil.html)**
and put it in /etc/elasticsearch/certs
nothing changes
besides that to get a working system now I have to set
```auto
xpack.security.enabled: false
xpack.security.enrollment.enabled: false
xpack.security.http.ssl.enabled: false
```
to get back to where I started.
I am on Ubuntu 20.04 LTS and I think I installed this via apt.
As I newbie, you give me some choices, I don't understand the difference.
Do you have some form of tldr like certbot?
> **[Certbot](https://certbot.eff.org/)**
>
> Tagline
These days there are 100s of programs, security updates, mails, tweets etc etc.
The whole attraction of a ready made system is to save time. Otherwise one can program it one self.
Most videos etc is for \< 8.2 and one spends already a considerable amount of time chasing the changes. Security that is complicated to install is by default insecure.
I also checked out this thread
> [@Unable to create an enrollment token for Kibana. "Elasticsearch node HTTP layer SSL configuration Keystore doesn't contain any PrivateKey entries where the associated certificate is a CA certificate"](https://discuss.elastic.co/t/unable-to-create-an-enrollment-token-for-kibana-elasticsearch-node-http-layer-ssl-configuration-keystore-doesnt-contain-any-privatekey-entries-where-the-associated-certificate-is-a-ca-certificate/297032):
>
> Hello, I tried today to setup my ELK stack securely so I followed the documentation and created all certs that I need using the certutil and encrypted the CA and the node cert with passwords. I placed the http.p12 file to /etc/Elasticsearch/certs/ Elasticsearch. Then I updated the keystone as told in the README: elasticsearch-keystore add "xpack.security.http.ssl.keystore.secure\_password" and typed my node's p12 password here. Now I wanted to add Kibana from another server so I tried to …
---
### Author:  [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)
#### Post date: [June 20, 2022, 12:42am UTC](https://discuss.elastic.co/t/creating-processor-set-security-user-tag-null-on-field-security-but-authentication-is-not-currently-enabled/306706/4 "2022-06-20T00:42:28Z")
I assume you are using Elasticsearch 8.2+. When installing it on ubuntu with the pacakge manager, security is auto-configured at **installation** time ([doc](https://www.elastic.co/guide/en/elasticsearch/reference/current/deb.html#deb-security-configuration)).
Since you had security disabled, I guess it's either because the installation was not a fresh install or you manually disabled security after installation.
Depending on how criticial the system is, you can either:
1. Retry with a fresh installation then follow the instruction printed on the terminal at installation time
2. Or you will have to configure security manually with the existing installation.
For 2, you'll have to let go the enrollment-token approach since it is designed to help auto-configuration while you are doing it manually. Please follow [this page](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-basic-setup.html) to enable basic security and followed by [this one](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-basic-setup-https.html) to enable TLS communication between ES and Kibana.
---
### Author:  [@flavienbwk](https://discuss.elastic.co/u/flavienbwk)
#### Post date: [June 20, 2022, 3:08pm UTC](https://discuss.elastic.co/t/creating-processor-set-security-user-tag-null-on-field-security-but-authentication-is-not-currently-enabled/306706/5 "2022-06-20T15:08:10Z")
Using Elasticsearch 8.2.3 with Docker I get the same problem. I am stuck to this error :
```auto
ERROR: Unable to create an enrollment token. Elasticsearch node HTTP layer SSL configuration is not configured with a keystore
```
The documentation is not working for me as well and I find Elasticsearch 8. a lot more complex to configure than version 7.
To get the following error, I had to generate P12 keystore certificates. But that's an error as well...
```auto
ERROR: Unable to create an enrollment token for Kibana. Elasticsearch node HTTP layer SSL configuration Keystore doesn't contain any PrivateKey entries where the associated certificate is a CA certificate
```
---
### Author:  [@K\_st\_rs](https://discuss.elastic.co/u/K_st_rs)
#### Post date: [June 26, 2022, 4:35pm UTC](https://discuss.elastic.co/t/creating-processor-set-security-user-tag-null-on-field-security-but-authentication-is-not-currently-enabled/306706/6 "2022-06-26T16:35:23Z")
Generally this is a test system.
Reinstalling everything seems to have worked.
In the beginning as a newbie, going off \< 8.x installs manuals on the web, one has no clue that this exists at all.
---
### Author:  [@flavienbwk](https://discuss.elastic.co/u/flavienbwk)
#### Post date: [June 26, 2022, 9:34pm UTC](https://discuss.elastic.co/t/creating-processor-set-security-user-tag-null-on-field-security-but-authentication-is-not-currently-enabled/306706/7 "2022-06-26T21:34:06Z")
It looks more like a bug : I use docker containers so the state is "reinitialized" at each run. This is a bug in the code, or a missing requirement in the documentation.
---
### Author:  [@K\_st\_rs](https://discuss.elastic.co/u/K_st_rs)
#### Post date: [June 27, 2022, 10:38am UTC](https://discuss.elastic.co/t/creating-processor-set-security-user-tag-null-on-field-security-but-authentication-is-not-currently-enabled/306706/8 "2022-06-27T10:38:30Z")
Well maybe I run into this again.
In the moment, I am trying the whole switch on switch off routine with some weird error in metric beat, before in logstash.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 25, 2022, 10:39am UTC](https://discuss.elastic.co/t/creating-processor-set-security-user-tag-null-on-field-security-but-authentication-is-not-currently-enabled/306706/9 "2022-07-25T10:39:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.