# Failed to retrieve password hash for reserved user \[kibana\]
**URL:** https://discuss.elastic.co/t/failed-to-retrieve-password-hash-for-reserved-user-kibana/193592
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [August 2, 2019, 4:08pm UTC](https://discuss.elastic.co/t/failed-to-retrieve-password-hash-for-reserved-user-kibana/193592 "2019-08-02T16:08:27Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@niudaye123](https://discuss.elastic.co/u/niudaye123)
#### Post date: [August 2, 2019, 4:08pm UTC](https://discuss.elastic.co/t/failed-to-retrieve-password-hash-for-reserved-user-kibana/193592/1 "2019-08-02T16:08:27Z")
I have to repurpose all the nodes in my cluster, during that process I accidentally deleted the \_security index which is for built in user information. Now in the log it said failed to retrieve password hash for reserved user [kibana].
I don't have snapshot made, how do I restore or rebuild this index so I can get kibana up?
thanks!
---
### Author:  [@ikakavas](https://discuss.elastic.co/u/ikakavas)
#### Post date: [August 2, 2019, 5:12pm UTC](https://discuss.elastic.co/t/failed-to-retrieve-password-hash-for-reserved-user-kibana/193592/2 "2019-08-02T17:12:39Z")
Hi there
@TimV's post from a couple of years back is still relevant: [Accidentally deleted .security index for x-pack - #3 by TimV](https://discuss.elastic.co/t/accidentally-deleted-security-index-for-x-pack/69844/3). Note that step 2
> From a security point of view, you now have a "new" cluster, so the reserved users `elastic` and `kibana` will have reset to their default _"changeme"_ passwords.
doesn't apply anymore since we do not have default passwords for the built-in users, but the rest of the instructions are good to go !
---
### Author:  [@niudaye123](https://discuss.elastic.co/u/niudaye123)
#### Post date: [August 2, 2019, 5:25pm UTC](https://discuss.elastic.co/t/failed-to-retrieve-password-hash-for-reserved-user-kibana/193592/3 "2019-08-02T17:25:42Z")
Thanks, I saw that post too, but when I tried to re-run the set password command, it gave me the following error. Did I miss any step before running this command?
[root@awselsprdlap01 bin]# ./elasticsearch-setup-passwords interactive
Failed to authenticate user 'elastic' against [http://10.172.128.33:9200/\_security/\_authenticate?pretty](http://10.172.128.33:9200/_security/_authenticate?pretty)
Possible causes include:
- The password for the 'elastic' user has already been changed on this cluster
- Your elasticsearch node is running against a different keystore
This tool used the keystore at /etc/elasticsearch/esnode01/elasticsearch.keystore
ERROR: Failed to verify bootstrap password
---
### Author:  [@niudaye123](https://discuss.elastic.co/u/niudaye123)
#### Post date: [August 5, 2019, 5:24pm UTC](https://discuss.elastic.co/t/failed-to-retrieve-password-hash-for-reserved-user-kibana/193592/4 "2019-08-05T17:24:32Z")
Hi, Please see the error I am getting, how do I resolve this? Should I delete the existing bootstrap password from keystore?
---
### Author:  [@ikakavas](https://discuss.elastic.co/u/ikakavas)
#### Post date: [August 6, 2019, 7:35am UTC](https://discuss.elastic.co/t/failed-to-retrieve-password-hash-for-reserved-user-kibana/193592/5 "2019-08-06T07:35:12Z")
What's the output of
```auto
bin/elasticsearch-keystore list
```
?
You would need to
1. set the `bootstrap.password` to something with
2. Restart the node, as the keystore is read on startup and changes to its values are not refreshed on runtime.
3. Run
4. You don't need the `bootstrap.password` anymore so you can remove it with
---
### Author:  [@niudaye123](https://discuss.elastic.co/u/niudaye123)
#### Post date: [August 6, 2019, 5:34pm UTC](https://discuss.elastic.co/t/failed-to-retrieve-password-hash-for-reserved-user-kibana/193592/6 "2019-08-06T17:34:23Z")
1. I set password for bootstrap.password per step 1. you provided. See below:
[root@awselsprdlap01 elasticsearch]# bin/elasticsearch-keystore list
bootstrap.password
keystore.seed
xpack.security.authc.realms.ldap.ldap1.secure\_bind\_password
1. Restarted nodes.
2. Still failed to start, see below:
[root@awselsprdlap01 elasticsearch]# bin/elasticsearch-setup-passwords interactive
Failed to authenticate user 'elastic' against [http://10.172.128.33:9200/\_security/\_authenticate?pretty](http://10.172.128.33:9200/_security/_authenticate?pretty)
Possible causes include:
- The password for the 'elastic' user has already been changed on this cluster
- Your elasticsearch node is running against a different keystore
This tool used the keystore at /etc/elasticsearch/esnode01/elasticsearch.keystore
ERROR: Failed to verify bootstrap password
---
### Author:  [@niudaye123](https://discuss.elastic.co/u/niudaye123)
#### Post date: [August 6, 2019, 5:35pm UTC](https://discuss.elastic.co/t/failed-to-retrieve-password-hash-for-reserved-user-kibana/193592/7 "2019-08-06T17:35:38Z")
Should I delete the keystore.seed? I believe that's the old password for bootstrap.password.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 3, 2019, 5:35pm UTC](https://discuss.elastic.co/t/failed-to-retrieve-password-hash-for-reserved-user-kibana/193592/8 "2019-09-03T17:35:41Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.