Default kibana user does not have access to elastic search indices

Elastic Stack Kibana
1

I'm in the process of evaluating ELK with x-pack. I have logstash inserting log data into ES and I can query ES to fetch the data using the default elastic user.

Kibana is accessing ES with a user called "kibana". This user seems to be restricted and can't be updated to add new permissions/roles in ES. In addition, I can't find a way to change the ES "kibana" user (the one the Kibana app uses to access ES) to a new user. It seems that the evaluation license maybe too restrictive.

Please let me know if you have any suggestions. I'm sure I'm missing something.

2

A user can be linked to multiple roles, so you can create a new role that provides access to you indices and then grant this and the kibana role to the user. This allows you to give different users access to different data sets with a small number of roles.

3

I created a new role and tried to add it to the kibana user that is used by the "Kibana" application, but it looks like the kibana user is "reserved" and its privileges cannot be changed. I also can't find a way to change the Kibana application to use a user other than "kibana" to access ES.

curl -XPOST 'elastic:changeme@localhost:9200/_xpack/security/user/kibana?pretty' -H 'Content-Type: application/json' -d'

{
"username" : "kibana",
"roles" : [
"kibana_system", "erichs_admin_role"
],
"full_name" : null,
"email" : null,
"enabled" : true
}
'
{
"error" : {
"root_cause" : [
{
"type" : "action_request_validation_exception",
"reason" : "Validation Failed: 1: Username [kibana] is reserved and may not be used.;"
}
],
"type" : "action_request_validation_exception",
"reason" : "Validation Failed: 1: Username [kibana] is reserved and may not be used.;"
},
"status" : 400
}

Let me know if you have any suggestions.

4

Ah, the kibana_system role should not be used here. Create a new user and assign the kibana_user and erichs_admin_role to it. That should solve the problem.

5

How do I change the Kibana application to use a different user? I couldn't find a way to do it. All the admin functions are locked out.

6

Nervermind. Now I just feel silly. I didn't realize I was logging into Kibana with the ES user. I assumed Kibana only had the default kibana user available as a login rather than mapping through to the ES user.

7

FYI we’ve renamed ELK to the Elastic Stack, otherwise Beats and APM feel left out! :wink:

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.