# Kibana Elasticsearch -\> after 7 Days elastic user pw changed **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security, docker\ **Created:** [May 27, 2021, 10:26am UTC](https://discuss.elastic.co/t/kibana-elasticsearch-after-7-days-elastic-user-pw-changed/274180 "2021-05-27T10:26:41Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![CleanerOne](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cleanerone/32/86343_2.png) [@CleanerOne](https://discuss.elastic.co/u/CleanerOne)\ **Post date:** [May 27, 2021, 10:26am UTC](https://discuss.elastic.co/t/kibana-elasticsearch-after-7-days-elastic-user-pw-changed/274180/1 "2021-05-27T10:26:41Z")
Hello Community Hello dear community, I have a problem ... I did Kibana and Elasticsearch after this tutorial > **[Setup Elasticsearch with Authentication (X-Pack Security) Enabled on...](https://www.studytonight.com/post/setup-elasticsearch-with-authentication-xpack-security-enabled-on-kubernetes)** > > How to Setup Elasticsearch cluster with master, data and client nodes with authentication enabled using the X-Pack security in Kubernetes. installed in an AKS (Azure Kubernetes cluster). everything runs well until after 7 days the setup thinks to change all generated passwords ... this leads to errors: ```auto {"type":"log","@timestamp":"2021-05-27T10:22:58+00:00","tags":["warning","plugins","licensing"],"pid":7,"message":"License information could not be obtained from Elasticsearch due to [security_exception] unable to authenticate user [elastic] for REST request [/_xpack?accept_enterprise=true], with { header={ WWW-Authenticate=\"Basic realm=\\\"security\\\" charset=\\\"UTF-8\\\"\" } } :: {\"path\":\"/_xpack?accept_enterprise=true\",\"statusCode\":401,\"response\":\"{\\\"error\\\":{\\\"root_cause\\\":[{\\\"type\\\":\\\"security_exception\\\",\\\"reason\\\":\\\"unable to authenticate user [elastic] for REST request [/_xpack?accept_enterprise=true]\\\",\\\"header\\\":{\\\"WWW-Authenticate\\\":\\\"Basic realm=\\\\\\\"security\\\\\\\" charset=\\\\\\\"UTF-8\\\\\\\"\\\"}}],\\\"type\\\":\\\"security_exception\\\",\\\"reason\\\":\\\"unable to authenticate user [elastic] for REST request [/_xpack?accept_enterprise=true]\\\",\\\"header\\\":{\\\"WWW-Authenticate\\\":\\\"Basic realm=\\\\\\\"security\\\\\\\" charset=\\\\\\\"UTF-8\\\\\\\"\\\"}},\\\"status\\\":401}\",\"wwwAuthenticateDirective\":\"Basic realm=\\\"security\\\" charset=\\\"UTF-8\\\"\"} error"} ``` I also tried to authenticate against Elasticsearch, unfortunately with no success because the PW's were changed. The solution is to change the passwords and to change them wherever they are stored. that kept the problem for another 7 days. This problem sounds very similar to me, but unfortunately I can't find the solution in the topic ... > [@If I enable xpack , Elasticsearch stops working and my license won't work](https://discuss.elastic.co/t/if-i-enable-xpack-elasticsearch-stops-working-and-my-license-wont-work/248690): > > I have been having an issue viewing the Kibana login page. Since the update to 7x for Elasticsearch and Kibana, I have not been able to access the login page nor has it been prompted for me. Is there any way that this can be solved?? ---
**Author:** ![CleanerOne](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cleanerone/32/86343_2.png) [@CleanerOne](https://discuss.elastic.co/u/CleanerOne)\ **Post date:** [May 31, 2021, 11:26am UTC](https://discuss.elastic.co/t/kibana-elasticsearch-after-7-days-elastic-user-pw-changed/274180/2 "2021-05-31T11:26:55Z")
Hello, nobody any Idee or questions ? ---
**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\ **Post date:** [May 31, 2021, 12:19pm UTC](https://discuss.elastic.co/t/kibana-elasticsearch-after-7-days-elastic-user-pw-changed/274180/3 "2021-05-31T12:19:48Z")
Elasticsearch does not automatically change or reset any password at all. I suspect there is something else going on. Based on the error message, you are using the `elastic` user which in most case is the builtin user. Did you change the password using the [ChangePassword API](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-change-password.html)? How did you do it when the previous password was changed and you didn't know what it was? Similarly, if you changed the password again, it does not seem possible for another process to change it again since it doesn't know the new password. So I'll take a wild guess, if you use ILM or similar (curator?), could you please check whether you have some policy that automatically rolls over the security index every 7 days? ---
**Author:** ![CleanerOne](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cleanerone/32/86343_2.png) [@CleanerOne](https://discuss.elastic.co/u/CleanerOne)\ **Post date:** [June 7, 2021, 6:02am UTC](https://discuss.elastic.co/t/kibana-elasticsearch-after-7-days-elastic-user-pw-changed/274180/4 "2021-06-07T06:02:10Z")
Hi @Yang_Wang, thx for your Reply i had a look about your hint but i dont found some curator stuff or similar. you have maybe a idea where or how to look about this ? ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [June 7, 2021, 6:23am UTC](https://discuss.elastic.co/t/kibana-elasticsearch-after-7-days-elastic-user-pw-changed/274180/5 "2021-06-07T06:23:28Z")
If you have a paid (or trial) license, then you can enable audit logs and work out where the password change is coming from. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [June 7, 2021, 6:32am UTC](https://discuss.elastic.co/t/kibana-elasticsearch-after-7-days-elastic-user-pw-changed/274180/6 "2021-06-07T06:32:32Z")
Alternatively, to test @Yang_Wang's theory about the security index being deleted every 7 days, login as the superuser (`elastic`) and run ```auto GET /.security ``` Then look for the `settings.index.creation_date` field On a newly created index you might have something like: ```auto "creation_date": "1623047288776", ``` You can enter that timestamp here: [Milliseconds to Date Converter (ms to date since epoch)](https://www.timecalculator.net/milliseconds-to-date) to find out when your security index was created. If that corresponds to when the password was change then it's a good sign that this is the problem. Are you losing any other data every 7 days, or is it just the password? Is it possible your nodes are being restarted and you don't have proper index storage setup? ---
**Author:** ![CleanerOne](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cleanerone/32/86343_2.png) [@CleanerOne](https://discuss.elastic.co/u/CleanerOne)\ **Post date:** [June 7, 2021, 6:47am UTC](https://discuss.elastic.co/t/kibana-elasticsearch-after-7-days-elastic-user-pw-changed/274180/7 "2021-06-07T06:47:34Z")
Hi TimV, > login as the superuser ( `elastic` ) and run not possible they change the passwords ... so i cant login with this credentials anymore i have to delete the Storages and make it new so i cant see the timestamp after 7Days > Are you losing any other data every 7 days, or is it just the password? > Is it possible your nodes are being restarted and you don't have proper index storage setup? nodes are not restarting ... Kubectl is not showing any restart and no i only lose the Passwords > If you have a paid (or trial) license, then you can enable audit logs and work out where the password change is coming from. so i have to make a fresh install of the System like posted in the First -\> [https://www.studytonight.com/post/setup-elasticsearch-with-authentication-xpack-security-enabled-on-kubernetes](https://www.studytonight.com/post/setup-elasticsearch-with-authentication-xpack-security-enabled-on-kubernetes) and have to activate the Trial and then i have to wait 7 days again ? ^^ ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2021, 6:47am UTC](https://discuss.elastic.co/t/kibana-elasticsearch-after-7-days-elastic-user-pw-changed/274180/8 "2021-07-05T06:47:35Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.