# Failed to authenticate user \[kibana\_system\]

**URL:** <https://discuss.elastic.co/t/failed-to-authenticate-user-kibana-system/282864>\
**Category:** Kibana\
**Created:** [August 31, 2021, 12:42am UTC](https://discuss.elastic.co/t/failed-to-authenticate-user-kibana-system/282864 "2021-08-31T00:42:15Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![yyyayo](https://avatars.discourse-cdn.com/v4/letter/y/76d3ee/32.png) [@yyyayo](https://discuss.elastic.co/u/yyyayo)\
**Post date:** [August 31, 2021, 12:42am UTC](https://discuss.elastic.co/t/failed-to-authenticate-user-kibana-system/282864/1 "2021-08-31T00:42:15Z")

</div>

When I tried Kibana development, I ran the following commands:

```auto
yarn es snapshot --license trial
yarn start --run-examples

```

Then I encountered an error in Elasticsearch:

```auto
failed to retrieve password hash for reserved user [kibana_system]
Authentication of [kibana_system] was terminated by realm [reserved] - failed to authenticate user [kibana_system]

```

And an error in Kibana:

```auto
[error][savedobjects-service] Unable to retrieve version information from Elasticsearch nodes. security_exception: [security_exception] Reason: unable to authenticate user [kibana_system] for REST request [/_nodes?filter_path=nodes.*.version%2Cnodes.*.http.publish_address%2Cnodes.*.ip]

```

I tried the default password for user [kibana\_system] in kibana.yml and also tried to change the password to "changeme" or "kibanapassword", but they all got errors. Can anyone help me?

---

<div class="post-metadata">

**Author:** ![rashmi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rashmi/32/16391_2.png) [@rashmi](https://discuss.elastic.co/u/rashmi)\
**Post date:** [August 31, 2021, 4:58am UTC](https://discuss.elastic.co/t/failed-to-authenticate-user-kibana-system/282864/2 "2021-08-31T04:58:01Z")

</div>

> [@yyyayo](#):
>
> `failed to authenticate user [kibana_system]`

It sounds like that you are using the wrong password. Did you set the password yourself or did you get auto-generated passwords from `setup-passwords` ?

You can test the passwords you think are correct against elasticsearch manually by running

`curl -u <user_here> 'http://localhost:9200/_xpack/security/_authenticate?pretty'`

replacing `<user_here>` with the relevant username ( `elastic` , `kibana` , `logstash_system` ) and entering the appropriate password for each.

hope this helps ? Thanks  
Rashmi

---

<div class="post-metadata">

**Author:** ![yyyayo](https://avatars.discourse-cdn.com/v4/letter/y/76d3ee/32.png) [@yyyayo](https://discuss.elastic.co/u/yyyayo)\
**Post date:** [August 31, 2021, 7:38am UTC](https://discuss.elastic.co/t/failed-to-authenticate-user-kibana-system/282864/3 "2021-08-31T07:38:14Z")

</div>

When I was running Elasticsearch by command `yarn es snapshot --license trial`, I tried to change **all users'** passwords to "changeme" by running `bin/elasticsearch-setup-passwords interactive` in `.es/8.0.0` foler in another terminal. However, I encountered the following error:

```auto
Connection failure to: http://127.0.0.1:9200/_security/user/apm_system/_password?pretty failed: Read timed out
ERROR: Failed to set password for user [apm_system].

```

I also tried to use `bin/elasticsearch` to run Elasticsearch, but I couldn't even change the passwords in this case. The following is the error message:

```auto
Failed to authenticate user 'elastic' against http://127.0.0.1:9200/_security/_authenticate?pretty
Possible causes include:
 * The password for the 'elastic' user has already been changed on this cluster
 * Your elasticsearch node is running against a different keystore
   This tool used the keystore at /Users/sheen/Desktop/kibana/.es/8.0.0/config/elasticsearch.keystore
ERROR: Failed to verify bootstrap password

```

---

<div class="post-metadata">

**Author:** ![yyyayo](https://avatars.discourse-cdn.com/v4/letter/y/76d3ee/32.png) [@yyyayo](https://discuss.elastic.co/u/yyyayo)\
**Post date:** [September 2, 2021, 2:38am UTC](https://discuss.elastic.co/t/failed-to-authenticate-user-kibana-system/282864/4 "2021-09-02T02:38:14Z")

</div>

I tried another branch (7.13) instead of the master branch in Kibana git repo and didn't encounter any errors. I believe the above errors might be caused by bugs in Elasticsearch 8.0.0 snapshot.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 30, 2021, 2:38am UTC](https://discuss.elastic.co/t/failed-to-authenticate-user-kibana-system/282864/5 "2021-09-30T02:38:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.