# How to set user elasticseach?

**URL:** <https://discuss.elastic.co/t/how-to-set-user-elasticseach/209217>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [November 25, 2019, 4:52am UTC](https://discuss.elastic.co/t/how-to-set-user-elasticseach/209217 "2019-11-25T04:52:51Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![chin](https://avatars.discourse-cdn.com/v4/letter/c/e9bcb4/32.png) [@chin](https://discuss.elastic.co/u/chin)\
**Post date:** [November 25, 2019, 4:52am UTC](https://discuss.elastic.co/t/how-to-set-user-elasticseach/209217/1 "2019-11-25T04:52:52Z")

</div>

elasticsearch version: 7.4.0  
I use 3 server to create 3 nodes

and  
set the elasticsearch.yml

```
discovery.seed_hosts: ["host1:9301", "host2:9301", "host3:9301"]
cluster.initial_master_nodes: ["node1", "node2", "node3"]

xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: none

```

but, if I like to set

```
bin/elasticsearch-setup-passwords interactive

```

the message will come up

```
Failed to determine the health of the cluster running at http://localhost:9200
Unexpected response code [503] from calling GET http://localhost:9200/_cluster/health?pretty
Cause: master_not_discovered_exception

It is recommended that you resolve the issues with your cluster before running elasticsearch-setup-passwords.
It is very likely that the password changes will fail when run against an unhealthy cluster.

```

how can I do?

---

<div class="post-metadata">

**Author:** ![amirhossein](https://avatars.discourse-cdn.com/v4/letter/a/278dde/32.png) [@amirhossein](https://discuss.elastic.co/u/amirhossein)\
**Post date:** [November 25, 2019, 5:53am UTC](https://discuss.elastic.co/t/how-to-set-user-elasticseach/209217/2 "2019-11-25T05:53:23Z")

</div>

Hi, what is output of this command:

`curl -X GET "http://100.72.138.59:9200/_cluster/health?pretty"`

---

<div class="post-metadata">

**Author:** ![chin](https://avatars.discourse-cdn.com/v4/letter/c/e9bcb4/32.png) [@chin](https://discuss.elastic.co/u/chin)\
**Post date:** [November 25, 2019, 6:09am UTC](https://discuss.elastic.co/t/how-to-set-user-elasticseach/209217/3 "2019-11-25T06:09:55Z")

</div>

```
{
  "error" : {
    "root_cause" : [
      {
        "type" : "security_exception",
        "reason" : "missing authentication credentials for REST request [/_cluster/health?pretty]",
        "header" : {
          "WWW-Authenticate" : "Basic realm=\"security\" charset=\"UTF-8\""
        }
      }
    ],
    "type" : "security_exception",
    "reason" : "missing authentication credentials for REST request [/_cluster/health?pretty]",
    "header" : {
      "WWW-Authenticate" : "Basic realm=\"security\" charset=\"UTF-8\""
    }
  },
  "status" : 401
}

```

it need to enter the password, but I haven't use

```
bin/elasticsearch-setup-passwords interactive

```

to reset the passwords

---

<div class="post-metadata">

**Author:** ![amirhossein](https://avatars.discourse-cdn.com/v4/letter/a/278dde/32.png) [@amirhossein](https://discuss.elastic.co/u/amirhossein)\
**Post date:** [November 25, 2019, 6:12am UTC](https://discuss.elastic.co/t/how-to-set-user-elasticseach/209217/4 "2019-11-25T06:12:34Z")

</div>

If you can reset your cluster, Set `xpack.security.enabled: false` in elasticsearch.yml and kibana.yml and restart elasticsearch service then run that command again

---

<div class="post-metadata">

**Author:** ![chin](https://avatars.discourse-cdn.com/v4/letter/c/e9bcb4/32.png) [@chin](https://discuss.elastic.co/u/chin)\
**Post date:** [November 25, 2019, 7:25am UTC](https://discuss.elastic.co/t/how-to-set-user-elasticseach/209217/5 "2019-11-25T07:25:02Z")

</div>

I will get the json

```
{
  "cluster_name" : "ClusterName",
  "status" : "green",
  "timed_out" : false,
  "number_of_nodes" : 3,
  "number_of_data_nodes" : 3,
  "active_primary_shards" : 0,
  "active_shards" : 0,
  "relocating_shards" : 0,
  "initializing_shards" : 0,
  "unassigned_shards" : 0,
  "delayed_unassigned_shards" : 0,
  "number_of_pending_tasks" : 0,
  "number_of_in_flight_fetch" : 0,
  "task_max_waiting_in_queue_millis" : 0,
  "active_shards_percent_as_number" : 100.0
}

```

by the way, when I set **xpack.security.enabled: true** and **xpack.security.transport.ssl.enabled: true** , I will get the information repeat again and again.

```
[2019-11-25T13:24:09,551][WARN][o.e.t.TcpTransport] [node1] exception caught on transport layer [Netty4TcpChannel{localAddress=0.0.0.0/0.0.0.0:40572, remoteAddress=[ins-dm-trvdm102z.prod.jp](https://slack-redir.net/link?url=http%3A%2F%2Fins-dm-trvdm102z.prod.jp).local/100.72.138.61:9300}], closing connection
io.netty.handler.codec.DecoderException: [javax.net](https://slack-redir.net/link?url=http%3A%2F%2Fjavax.net).ssl.SSLException: Received fatal alert: handshake_failure
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:475) ~[netty-codec-4.1.38.Final.jar:4.1.38.Final]
at io.netty.handler.codec.ByteToMessageDecoder.channelInputClosed(ByteToMessageDecoder.java:408) ~[netty-codec-4.1.38.Final.jar:4.1.38.Final]
at io.netty.handler.codec.ByteToMessageDecoder.channelInputClosed(ByteToMessageDecoder.java:375) ~[netty-codec-4.1.38.Final.jar:4.1.38.Final]
at io.netty.handler.codec.ByteToMessageDecoder.channelInactive(ByteToMessageDecoder.java:358) ~[netty-codec-4.1.38.Final.jar:4.1.38.Final]
at io.netty.handler.ssl.SslHandler.channelInactive(SslHandler.java:1075) ~[netty-handler-4.1.38.Final.jar:4.1.38.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelInactive(AbstractChannelHandlerContext.java:257) [netty-transport-4.1.38.Final.jar:4.1.38.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelInactive(AbstractChannelHandlerContext.java:243) [netty-transport-4.1.38.Final.jar:4.1.38.Final]
at io.netty.channel.AbstractChannelHandlerContext.fireChannelInactive(AbstractChannelHandlerContext.java:236) [netty-transport-4.1.38.Final.jar:4.1.38.Final]
at io.netty.channel.DefaultChannelPipeline$HeadContext.channelInactive(DefaultChannelPipeline.java:1416) [netty-transport-4.1.38.Final.jar:4.1.38.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelInactive(AbstractChannelHandlerContext.java:257) [netty-transport-4.1.38.Final.jar:4.1.38.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelInactive(AbstractChannelHandlerContext.java:243) [netty-transport-4.1.38.Final.jar:4.1.38.Final]
at io.netty.channel.DefaultChannelPipeline.fireChannelInactive(DefaultChannelPipeline.java:912) [netty-transport-4.1.38.Final.jar:4.1.38.Final]
at io.netty.channel.AbstractChannel$AbstractUnsafe$8.run(AbstractChannel.java:816) [netty-transport-4.1.38.Final.jar:4.1.38.Final]
at io.netty.util.concurrent.AbstractEventExecutor.safeExecute(AbstractEventExecutor.java:163) [netty-common-4.1.38.Final.jar:4.1.38.Final]
at io.netty.util.concurrent.SingleThreadEventExecutor.runAllTasks(SingleThreadEventExecutor.java:416) [netty-common-4.1.38.Final.jar:4.1.38.Final]
at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:515) [netty-transport-4.1.38.Final.jar:4.1.38.Final]
at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:918) [netty-common-4.1.38.Final.jar:4.1.38.Final]
at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74) [netty-common-4.1.38.Final.jar:4.1.38.Final]
at java.lang.Thread.run(Thread.java:748) [?:1.8.0_141]
Caused by: [javax.net](https://slack-redir.net/link?url=http%3A%2F%2Fjavax.net).ssl.SSLException: Received fatal alert: handshake_failure
at sun.security.ssl.Alerts.getSSLException(Alerts.java:208) ~[?:?]
at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1666) ~[?:?]
at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1634) ~[?:?]
at sun.security.ssl.SSLEngineImpl.recvAlert(SSLEngineImpl.java:1800) ~[?:?]
at sun.security.ssl.SSLEngineImpl.readRecord(SSLEngineImpl.java:1083) ~[?:?]
at sun.security.ssl.SSLEngineImpl.readNetRecord(SSLEngineImpl.java:907) ~[?:?]
at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:781) ~[?:?]
at [javax.net](https://slack-redir.net/link?url=http%3A%2F%2Fjavax.net).ssl.SSLEngine.unwrap(SSLEngine.java:624) ~[?:1.8.0_141]
at io.netty.handler.ssl.SslHandler$SslEngineType$3.unwrap(SslHandler.java:282) ~[netty-handler-4.1.38.Final.jar:4.1.38.Final]
at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1329) ~[netty-handler-4.1.38.Final.jar:4.1.38.Final]
at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1224) ~[netty-handler-4.1.38.Final.jar:4.1.38.Final]
at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1271) ~[netty-handler-4.1.38.Final.jar:4.1.38.Final]
at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:505) ~[netty-codec-4.1.38.Final.jar:4.1.38.Final]
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:444) ~[netty-codec-4.1.38.Final.jar:4.1.38.Final]
... 18 more
```

---

<div class="post-metadata">

**Author:** ![amirhossein](https://avatars.discourse-cdn.com/v4/letter/a/278dde/32.png) [@amirhossein](https://discuss.elastic.co/u/amirhossein)\
**Post date:** [November 25, 2019, 7:50am UTC](https://discuss.elastic.co/t/how-to-set-user-elasticseach/209217/6 "2019-11-25T07:50:11Z")

</div>

See: [link](https://discuss.elastic.co/t/exception-caught-on-transport-layer-es6-4-2/163924/7) or [doc](https://www.elastic.co/guide/en/elasticsearch/reference/7.4/java-clients.html)

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [November 25, 2019, 8:32am UTC](https://discuss.elastic.co/t/how-to-set-user-elasticseach/209217/7 "2019-11-25T08:32:52Z")

</div>

You can't just enable TLS for the transport layer without configuring the keys and certificates to be used for TLS. Please read through the whole page at [https://www.elastic.co/guide/en/elasticsearch/reference/current/configuring-tls.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/configuring-tls.html) and specifically [how to configure TLS for the transport layer here](https://www.elastic.co/guide/en/elasticsearch/reference/current/configuring-tls.html#tls-transport).

```auto
discovery.seed_hosts: ["host1:9301", "host2:9301", "host3:9301"]

```

Have you also configured the Elasticsearch nodes on all hosts to listen to 9301 instead of the default 9300 ?

It would be great if you could share your whole `elasticsearch.yml` so that other community members can make proper suggestions based on your actual configuration, rather than educated guesses 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 23, 2019, 8:33am UTC](https://discuss.elastic.co/t/how-to-set-user-elasticseach/209217/8 "2019-12-23T08:33:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.