# Elasticsearch build-in user changed password **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [June 18, 2021, 1:38am UTC](https://discuss.elastic.co/t/elasticsearch-build-in-user-changed-password/276330 "2021-06-18T01:38:33Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![drewkrrb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/drewkrrb/32/78907_2.png) [@drewkrrb](https://discuss.elastic.co/u/drewkrrb)\ **Post date:** [June 18, 2021, 1:38am UTC](https://discuss.elastic.co/t/elasticsearch-build-in-user-changed-password/276330/1 "2021-06-18T01:38:33Z")
Hi all Our Elasticsearch environment is deployed on our kubernetes platform using the official helm chart. We only have 2 elasticsearch pods. We are using xpack.security.enabled: true and setup the password for elastic build-in account by creating a kubernetes secret and using extraEnvs for the chart. ```auto extraEnvs: - name: ELASTIC_PASSWORD valueFrom: secretKeyRef: name: elastic-credentials key: password - name: ELASTIC_USERNAME valueFrom: secretKeyRef: name: elastic-credentials key: username ``` We have a requirement to change the password every 3 months for users that is able to login on kibana this includes the elastic built-in account. Upon trying to change the elastic built-in account am getting this error and my cluster stop. ```auto {"type": "server", "timestamp": "2021-06-17T08:47:32,208Z", "level": "INFO", "component": "o.e.x.s.a.AuthenticationService", "cluster.name": "elastic", "node.name": "elastic-master-0", "message": "Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]", "cluster.uuid": "02_vnO8NQs2sXEawOdE6mQ", "node.id": "-wQ_uf-VR52tzq_UyXR-Og" } {"type": "server", "timestamp": "2021-06-17T08:47:42,195Z", "level": "INFO", "component": "o.e.x.s.a.AuthenticationService", "cluster.name": "elastic", "node.name": "elastic-master-0", "message": "Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]", "cluster.uuid": "02_vnO8NQs2sXEawOdE6mQ", "node.id": "-wQ_uf-VR52tzq_UyXR-Og" } {"type": "server", "timestamp": "2021-06-17T08:47:44,287Z", "level": "INFO", "component": "o.e.x.s.a.AuthenticationService", "cluster.name": "elastic", "node.name": "elastic-master-0", "message": "Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]", "cluster.uuid": "02_vnO8NQs2sXEawOdE6mQ", "node.id": "-wQ_uf-VR52tzq_UyXR-Og" } ``` Does this mean in order to change the password for elastic built-in account I have to redeploy the cluster again? Creating a new kubernetes secrets and using that for the deployment of elastic. Or is there a way for the elastic built in account not able to log-in to kibana but still able to talk to other nodes in elastic? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [June 18, 2021, 2:22am UTC](https://discuss.elastic.co/t/elasticsearch-build-in-user-changed-password/276330/2 "2021-06-18T02:22:55Z")
How are you resetting the password every 3 months at the moment? ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [June 18, 2021, 2:50am UTC](https://discuss.elastic.co/t/elasticsearch-build-in-user-changed-password/276330/3 "2021-06-18T02:50:37Z")
The problem here is that the [readiness probe](https://github.com/elastic/helm-charts/blob/c2689ff4241bc6a75f591dcc2c49a409eb8ef90e/elasticsearch/templates/statefulset.yaml#L226) uses `$ELASTIC_USERNAME` and `$ELASTIC_PASSWORD`, so if you change the password for `$ELASTIC_USERNAME`, the readiness probe fails. I think what you want to do here is stop using `elastic` for your `$ELASTIC_USERNAME`. That's a good change to make anyway, because `elastic` is a `superuser`, and it's preferable not to run probes as a superuser. Create a new user with the `monitor` cluster privilege so it can run the readiness probe. It will not be able to login to Kibana, so it will not fall under your password policy. Then change `$ELASTIC_USER` to use that new username instead, and you _should_ be safe to change the `elastic` password after that. I suspect (but I'm not an expert since I don't work on the Helm charts) that the _initial_ password for your `elastic` user (on a brand new cluster) will default to `$ELASTIC_PASSWORD`. You could open issue on the Helm GitHub repo and ask about support for a specific `PROBE_USERNAME` and `PROBE_PASSWORD` so this is a bit simpler. It seems like a reasonable feature (but it's not something I work on, so there may be reasons why it's not as useful as it sounds). ---
**Author:** ![drewkrrb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/drewkrrb/32/78907_2.png) [@drewkrrb](https://discuss.elastic.co/u/drewkrrb)\ **Post date:** [June 18, 2021, 3:04am UTC](https://discuss.elastic.co/t/elasticsearch-build-in-user-changed-password/276330/4 "2021-06-18T03:04:10Z")
Currently done manually. When we have the license we are planning to use our existing ldap for the users. Our ldap configuration changes the users password every 3 months. ---
**Author:** ![drewkrrb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/drewkrrb/32/78907_2.png) [@drewkrrb](https://discuss.elastic.co/u/drewkrrb)\ **Post date:** [June 18, 2021, 3:17am UTC](https://discuss.elastic.co/t/elasticsearch-build-in-user-changed-password/276330/5 "2021-06-18T03:17:09Z")
Are there any of these built-in users have the privillage monitoring cluster privilege? - kibana\_system - logstash\_system - logstash\_system - apm\_system - remote\_monitoring\_user The reason why am asking is am not sure what is the sequence how can I create a new user, using the helm chart. Since the the user with the monitor cluster privilege wont be able to log-in on kibana there is no need to change the password as part of our policy. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [June 18, 2021, 3:44am UTC](https://discuss.elastic.co/t/elasticsearch-build-in-user-changed-password/276330/6 "2021-06-18T03:44:53Z")
`remote_monitoring_user` has `monitor` access, but I'm not sure how you will set its initial password to something you can use in the readiness probe. Instead, I think you will need to create a new user in the [`file` realm](https://www.elastic.co/guide/en/elasticsearch/reference/current/file-realm.html) as part of the Helm chart. I am not an expert on k8s or helm, but I think you should be able to use the [`postStart`](https://github.com/elastic/helm-charts/tree/master/elasticsearch#how-to-configure-templates-post-deployment) lifecycle hook to [create a user](https://www.elastic.co/guide/en/elasticsearch/reference/current/users-command.html) and assign it a role that has access to perform monitoring - e.g. `remote_monitoring_collector` or a custom role defined in [roles.yml](https://www.elastic.co/guide/en/elasticsearch/reference/current/defining-roles.html#roles-management-file). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 16, 2021, 3:45am UTC](https://discuss.elastic.co/t/elasticsearch-build-in-user-changed-password/276330/7 "2021-07-16T03:45:10Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.