# I lost the password that has been changed

**URL:** https://discuss.elastic.co/t/i-lost-the-password-that-has-been-changed/91867
**Category:** Elasticsearch
**Created:** [July 5, 2017, 9:16am UTC](https://discuss.elastic.co/t/i-lost-the-password-that-has-been-changed/91867 "2017-07-05T09:16:21Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [July 5, 2017, 1:26pm UTC](https://discuss.elastic.co/t/i-lost-the-password-that-has-been-changed/91867/2 "2017-07-05T13:26:08Z")

</div>

* * *

_ **Note** : These instructions are quite old. Newer instructions are available here_

- [X-Pack Authentication issue](https://discuss.elastic.co/t/x-pack-authentication-issue/121632/7)

* * *

It is possible to reset the `elastic` user password (see below) but from your description, it doesn't sound like this is necessarily what you need.

The `elastic` user is a _superuser_. We don't recommend using it for any purpose other than administering the system.

In particular, _Kibana_ should not connect to Elasticsearch using the _elastic_ user - by default it uses the _kibana_ user, so the password you are putting into the `kibana.yml` file should be the password for the `kibana` user, not the `elastic` user.

And there should be no reason to put that password into the `elasticsearch.yml` file - in fact if you do so, elasticsearch won't start, because `elasticsearch.password` isn't a valid setting in `elasticsearch.yml`.

Before you go through the trouble of reseting the `elastic` password, double check that it really isn't working.

Assuming you have access to curl, run the following:

```
curl -u elastic 'http://localhost:9200/_xpack/security/_authenticate?pretty'

```

(You may need to change the URL if you are not on localhost, or you are using a custom port number).

When prompted, enter the password that you think you set for the `elastic` user. If you get output like this:

```auto
{
  "username" : "elastic",
  "roles" : [
    "superuser"
  ],
  "full_name" : null,
  "email" : null,
  "metadata" : {
    "_reserved" : true
  },
  "enabled" : true
}

```

Then your password is correct, and the problems you are seeing are due to some other configuration problem.

If you get something like this:

```auto
{
  "error" : {
    "root_cause" : [
      {
        "type" : "security_exception",
        "reason" : "failed to authenticate user [elastic]",
        "header" : {
          "WWW-Authenticate" : "Basic realm=\"security\" charset=\"UTF-8\""
        }
      }
    ],
    "type" : "security_exception",
    "reason" : "failed to authenticate user [elastic]",
    "header" : {
      "WWW-Authenticate" : "Basic realm=\"security\" charset=\"UTF-8\""
    }
  },
  "status" : 401
}

```

Then you have the incorrect password and you should try a different password, of if absolutely necessary, reset the password for the user.

### Reseting the password for the elastic user

To do this, you need to create an alternate _superuser_ and then authenticate as that user in order to change the password for _elastic_. This requires a number of steps.

**(1)** Stop your elasticsearch node  
**(2)** Ensure that the _file_ realm is available on your elasticsearch node. If you are using a default X-Pack configuration for authentication, then the file realm is available and you don't need to do anything. However, if you have explicitly configured the [authentication realms](https://www.elastic.co/guide/en/x-pack/5.4/_how_authentication_works.html) in your `elasticsearch.yml` file, then you need to [add a `file` realm](https://www.elastic.co/guide/en/x-pack/5.4/file-realm.html#_configuring_a_file_realm) to the list of realms.  
**(3)** Use the `bin/x-pack/users` command to [create a new file-based](https://www.elastic.co/guide/en/x-pack/5.4/file-realm.html#file-realm-add-user) superuser:

```auto
 bin/x-pack/users useradd my_admin -p my_password -r superuser

```

**(4)** Start your elasticsearch node  
**(5)** Using curl, [reset the password](https://www.elastic.co/guide/en/x-pack/5.4/security-api-users.html#security-api-reset-user-password) for the elastic user:

```auto
curl -u my_admin -XPUT 'http://localhost:9200/_xpack/security/user/elastic/_password?pretty' -H 'Content-Type: application/json' -d'
{
  "password" : "new_password"
}
' 

```

**(6)** Verify the new password

```auto
curl -u elastic 'http://localhost:9200/_xpack/security/_authenticate?pretty'

```

**(7)** If you wish, stop elasticsearch and then remove the _file_ realm from your `elasticsearch.yml` and/or [remove](https://www.elastic.co/guide/en/x-pack/5.4/file-realm.html#file-realm-remove-user) the _my\_admin_ user from the file realm.

---

_[View the full topic](https://discuss.elastic.co/t/i-lost-the-password-that-has-been-changed/91867)._