Elastic Detections permissions issues

[Frank_Hassanabad]

Hi @yarooski,

I think you posted your other problem here:

Can't start elasticsearch service after enabling TLS for Detections/Alerts - Permission Denied

After following these instructions meticulously: How To Install Elasticsearch, Logstash, and Kibana (Elastic Stack) on Ubuntu 20.04 And then enabling TLS and setting up user permissions here: Detections prerequisites and requirements We repeatedly run into a permissions issue when trying to start the elasticsearch service: ./elasticsearch-env: line 81: /etc/default/elasticsearch: Permission denied After doing an ls -l on the directory, all files are owned by the elasticsearch user created du…

And I think you also posted on reddit too, no? We try to track a lot of these problems and help people across multiple social platforms.
https://www.reddit.com/r/elasticsearch/comments/kyowf2/cant_start_elasticsearch_service_after_enabling/

Getting TLS setup is the first step for sure and there are hiccups with how operating systems work with security that are inherently tricky. Once you sleuth out and get TLS setup again, if you run into problems with the instructions on how to get detection engine setup there is a more in-depth trouble shooting guide here that might help you out with any gotcha's fwiw:

Detections will not setup

Hello Frank, thank you for your feedback. This is a really helpful to check / debug the permissions. You are right, i have a elastic on prem setup as a cluster. Its for my company. I have check what you tell me, but the permissions looks good.But i notice the encryption key part. I have one in my config, but i check it again. Thank you very much! [grafik] [grafik]