# I can't authenticate using 'elastic' , 'kibana\_system' in ELK version 8.5

**URL:** <https://discuss.elastic.co/t/i-cant-authenticate-using-elastic-kibana-system-in-elk-version-8-5/333455>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [May 15, 2023, 12:01pm UTC](https://discuss.elastic.co/t/i-cant-authenticate-using-elastic-kibana-system-in-elk-version-8-5/333455 "2023-05-15T12:01:07Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![linux\_admin](https://avatars.discourse-cdn.com/v4/letter/l/c0e974/32.png) [@linux\_admin](https://discuss.elastic.co/u/linux_admin)\
**Post date:** [May 15, 2023, 12:01pm UTC](https://discuss.elastic.co/t/i-cant-authenticate-using-elastic-kibana-system-in-elk-version-8-5/333455/1 "2023-05-15T12:01:07Z")

</div>

I am using ELK cluster consists of **three** nodes. I can't access Kibana using its URL https://kibana\_IP:5601.

When I checked the logs of **/var/log/elasticsearch/elasticsearch.log** I found these errors:

`Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]`

When I checked the logs of kibana, I found the below error:

`Unable to authenticate user [kibana_system] for REST request [/_nodes?filter_path=nodes.*.version%2Cnodes.*.http.publish_address%2Cnodes.*.ip]`

I tried to reset the password for elastic user using this command **/usr/share/elasticsearch/bin/elasticsearch-reset-password -i -u elastic**

but I got this error:

`Error: Failed to determine the health of the cluster. Cluster health is currently RED`

I checked elastisearch service in all nodes and it is up and running.

How to solve this problem, please?

Regards,

---

<div class="post-metadata">

**Author:** ![carly.richmond](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carly.richmond/32/104935_2.png) [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)\
**Post date:** [May 15, 2023, 3:50pm UTC](https://discuss.elastic.co/t/i-cant-authenticate-using-elastic-kibana-system-in-elk-version-8-5/333455/2 "2023-05-15T15:50:10Z")

</div>

Hi @linux_admin,

Have you checked the health of the cluster using the [`_cluster/health` API?](https://www.elastic.co/guide/en/elasticsearch/reference/current/cluster-health.html)?

Do you have the password for the `elastic` and `kibana_system` users? There is also a useful way to check passwords in [this topic](https://discuss.elastic.co/t/failed-to-authenticate-user-kibana-system/282864).

---

<div class="post-metadata">

**Author:** ![linux\_admin](https://avatars.discourse-cdn.com/v4/letter/l/c0e974/32.png) [@linux\_admin](https://discuss.elastic.co/u/linux_admin)\
**Post date:** [May 16, 2023, 9:00am UTC](https://discuss.elastic.co/t/i-cant-authenticate-using-elastic-kibana-system-in-elk-version-8-5/333455/3 "2023-05-16T09:00:53Z")

</div>

Hi @carly.richmond  
Thanks for your support!  
The problem has been solved using the followings:

1. Stop elasticsearch service on all cluster nodes using `systemctl stop elasticsearch`

2. Set `xpack.security.enabled: false` in `elasticsearch.yml` on all nodes, and restart elasticsearch on all nodes using `systemctl start elasticsearch`

3. Reset `elastic` and `kibana_system` users password using `bin/elasticsearch-reset-password -u elastic --interactive` and `bin/elasticsearch-reset-password -u kibana_system --interactive`

4. Update `/etc/kibana/kibana.yml` with the new password of `kibana_system`

5. Stop `elasticsearch` service on all nodes again using `systemctl stop elasticsearch`

6. Reenable `xpack.security.enabled: true` in `elasticsearch.yml` on all nodes, and restart elasticsearch on all nodes using `systemctl start elasticsearch`

7. Restart kibana service

---

<div class="post-metadata">

**Author:** ![carly.richmond](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carly.richmond/32/104935_2.png) [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)\
**Post date:** [May 16, 2023, 9:02am UTC](https://discuss.elastic.co/t/i-cant-authenticate-using-elastic-kibana-system-in-elk-version-8-5/333455/4 "2023-05-16T09:02:30Z")

</div>

Great, thanks for sharing the solution @linux_admin!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 13, 2023, 9:02am UTC](https://discuss.elastic.co/t/i-cant-authenticate-using-elastic-kibana-system-in-elk-version-8-5/333455/5 "2023-06-13T09:02:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.