# Kibana login

**URL:** <https://discuss.elastic.co/t/kibana-login/49000>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [May 2, 2016, 9:40pm UTC](https://discuss.elastic.co/t/kibana-login/49000 "2016-05-02T21:40:59Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Andre\_de\_Martini](https://avatars.discourse-cdn.com/v4/letter/a/e79b87/32.png) [@Andre\_de\_Martini](https://discuss.elastic.co/u/Andre_de_Martini)\
**Post date:** [May 2, 2016, 9:40pm UTC](https://discuss.elastic.co/t/kibana-login/49000/1 "2016-05-02T21:40:59Z")

</div>

Hey guys.  
I installed shield to my elk server, but now i cannot access my kibana anymore.

I did all that this ([https://www.elastic.co/guide/en/shield/current/kibana.html](https://www.elastic.co/guide/en/shield/current/kibana.html)) tutorial ask for, but the kibana page always says that the username or the password is wrong.

I am sure that the user/password is correct because I use it to check/add users with the command " POST \_shield/user".

Example:  
`GET http://localhost:9200/_shield/user Enter username for shield at localhost:9200: amartini Password: {"amartini":{"username":"amartini","roles":["admin"],"full_name":null,"email":null,"metadata":#{}}}[`

file: elasticsearch.yml  
`path.data: /export/stack path.logs: /export/logs/elasticsearch network.host: localhost shield.audit.enabled: true`

file: kibana.yml  
`server.host: "localhost" elasticsearch.url: "https://localhost:9200" elasticsearch.username: "kibana" elasticsearch.password: "abc123" server.ssl.cert: /etc/ssl/certs/Wildcard-fcl-SHA2.cert server.ssl.key: /etc/ssl/certs/Wildcard-fcl-SHA2.key elasticsearch.ssl.ca: /etc/ssl/certs/Wildcard-fcl-SHA2.pem logging.dest: /export/logs/kibana/kibana.log`

Please help me =(

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 3, 2016, 4:07am UTC](https://discuss.elastic.co/t/kibana-login/49000/2 "2016-05-03T04:07:10Z")

</div>

Check the access logs in ES and it should give you some details on what is happening.

---

<div class="post-metadata">

**Author:** ![Andre\_de\_Martini](https://avatars.discourse-cdn.com/v4/letter/a/e79b87/32.png) [@Andre\_de\_Martini](https://discuss.elastic.co/u/Andre_de_Martini)\
**Post date:** [May 3, 2016, 1:16pm UTC](https://discuss.elastic.co/t/kibana-login/49000/3 "2016-05-03T13:16:56Z")

</div>

The only log that is being populated is the elasticsearch-access.log.  
It is logging this message every 2 seconds:  
`[2016-05-03 10:14:58,624] [Midas] [rest] [anonymous_access_denied]	origin_address=[edited:MYIP], uri=[/_bulk]`

---

<div class="post-metadata">

**Author:** ![Andre\_de\_Martini](https://avatars.discourse-cdn.com/v4/letter/a/e79b87/32.png) [@Andre\_de\_Martini](https://discuss.elastic.co/u/Andre_de_Martini)\
**Post date:** [May 3, 2016, 3:09pm UTC](https://discuss.elastic.co/t/kibana-login/49000/4 "2016-05-03T15:09:53Z")

</div>

Dont know if it helps but this log message occurs even if kibana is down.  
I tough that only the kibana ask information from ES.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 3, 2016, 8:59pm UTC](https://discuss.elastic.co/t/kibana-login/49000/5 "2016-05-03T20:59:30Z")

</div>

It could be Logstash.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:44pm UTC](https://discuss.elastic.co/t/kibana-login/49000/6 "2017-07-06T13:44:54Z")

</div>