# Linux ps command shows Elasticsearch password **URL:** \ **Category:** Kibana\ **Tags:** elastic-stack-security, docker\ **Created:** [May 27, 2020, 9:21pm UTC](https://discuss.elastic.co/t/linux-ps-command-shows-elasticsearch-password/234621 "2020-05-27T21:21:39Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![silentfilm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/silentfilm/32/44348_2.png) [@silentfilm](https://discuss.elastic.co/u/silentfilm)\ **Post date:** [May 27, 2020, 9:21pm UTC](https://discuss.elastic.co/t/linux-ps-command-shows-elasticsearch-password/234621/1 "2020-05-27T21:21:39Z")
We are running docker versions of Kibana and Elasticsearch. When kibana is running, you can use a Linux "ps" command to see the Elasticsearch password. `geo 233087 232961 6 21:11 ? 00:00:06 /usr/share/kibana/bin/../node/bin/node --no-warnings --max-http-header-size=65536 /usr/share/kibana/bin/../src/cli --cpu.cgroup.path.override=/ --cpuacct.cgroup.path.override=/ --elasticsearch.password=xxxxxxxx --elasticsearch.username=xxxxxxxx` We are not using xpack. I tried modifying kibana.yml and removing elasticsearch.password. While this removes it from the Linux run line, Kibana must have the password to connect to Elasticsearch. Is there any way to mask the password, or pass it to Kibana another way. ---
**Author:** ![Luca\_Belluccini](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/luca_belluccini/32/33239_2.png) [@Luca\_Belluccini](https://discuss.elastic.co/u/Luca_Belluccini)\ **Post date:** [May 27, 2020, 9:38pm UTC](https://discuss.elastic.co/t/linux-ps-command-shows-elasticsearch-password/234621/2 "2020-05-27T21:38:05Z")
You can use the Kibana keystore [https://www.elastic.co/guide/en/kibana/current/secure-settings.html](https://www.elastic.co/guide/en/kibana/current/secure-settings.html) ---
**Author:** ![joshbressers](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joshbressers/32/42332_2.png) [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Post date:** [May 27, 2020, 9:49pm UTC](https://discuss.elastic.co/t/linux-ps-command-shows-elasticsearch-password/234621/3 "2020-05-27T21:49:09Z")
@silentfilm Can you verify you are not setting the ELASTICSEARCH\_USERNAME and ELASTICSEARCH\_PASSWORD environment variables? ---
**Author:** ![silentfilm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/silentfilm/32/44348_2.png) [@silentfilm](https://discuss.elastic.co/u/silentfilm)\ **Post date:** [May 28, 2020, 3:44pm UTC](https://discuss.elastic.co/t/linux-ps-command-shows-elasticsearch-password/234621/4 "2020-05-28T15:44:07Z")
They are normally set when passed in as parameters: `[root@kibana-aln-nbadev4 kibana]# env | grep ELASTICSEARCH ELASTICSEARCH_USERNAME=kibanaserver ELASTICSEARCH_PASSWORD=xxxxxxxx` If I remove elasticsearch.password from the variables listed in the kibana-docker file, kibana runs and the ps display does not include the password.: `geo 349877 349740 12 15:33 ? 00:00:05 /usr/share/kibana/bin/../node/bin/node --no-warnings --max-http-header-size=65536 /usr/share/kibana/bin/../src/cli --cpu.cgroup.path.override=/ --cpuacct.cgroup.path.override=/ --elasticsearch.username=kibanaserver` However, my browser says "Kibana is not ready yet." The Kibana docker image still has these environment variables set: `[root@kibana-aln-nbadev4 kibana]# env | grep ELASTICSEARCH ELASTICSEARCH_USERNAME=kibanaserver ELASTICSEARCH_PASSWORD=xxxxxxxx` The Kibana log says, `{"log":"{\"type\":\"log\",\"@timestamp\":\"2020-05-27T19:36:47Z\",\"tags\":[\"fatal\",\"root\"],\"pid\":15,\"message\":\"{ Error: \\\"elasticsearch-password\\\" setting was not applied. Check for spelling errors and ensure that expected plugins are installed.\\n at KbnServer.exports.default (/usr/share/kibana/src/server/config/complete.js:88:17) code: 'InvalidConfig', processExitCode: 64 }\"}\n","stream":"stdout","time":"2020-05-27T19:36:47.531180187Z"} {"log":"\n","stream":"stderr","time":"2020-05-27T19:36:47.534092211Z"} {"log":" FATAL Error: \"elasticsearch-password\" setting was not applied. Check for spelling errors and ensure that expected plugins are installed.\n","stream":"stderr","time":"2020-05-27T19:36:47.534137206Z"}` ---
**Author:** ![joshbressers](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joshbressers/32/42332_2.png) [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Post date:** [May 28, 2020, 5:36pm UTC](https://discuss.elastic.co/t/linux-ps-command-shows-elasticsearch-password/234621/5 "2020-05-28T17:36:26Z")
OK, I think I follow all this now. This is expected behavior. The environment variables end up as command line options for the Kibana process. We are going to update the documentation to make this more clear moving forward. The easiest way to solve this problem is to bind mount a kibana.yml file into your container that contains the username and password. The docs for doing this can be found here [https://www.elastic.co/guide/en/kibana/current/docker.html#bind-mount-config](https://www.elastic.co/guide/en/kibana/current/docker.html#bind-mount-config) You can also use the Kibana keystore but it's more involved than bind mounting a configuration file. I hope this helps. ---
**Author:** ![silentfilm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/silentfilm/32/44348_2.png) [@silentfilm](https://discuss.elastic.co/u/silentfilm)\ **Post date:** [June 2, 2020, 9:36pm UTC](https://discuss.elastic.co/t/linux-ps-command-shows-elasticsearch-password/234621/6 "2020-06-02T21:36:59Z")
Thanks, his does work, as defining elasticsearch.password in the bind-mounted kibana.yml file will allow Kibana to run without is being shown in the "ps -ef" display. I'm actually defining it as `elasticsearch.password: ${ELASTICSEARCH_PASSWORD:}` However, I also have to edit the kibana-docker file (inside the docker container) and remove the elasticsearch.password line there. This keeps the password from being included on the run line (and the ps display line). Where is this file created? I can't find it in our source code. Is it part of the docker image? ---
**Author:** ![joshbressers](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joshbressers/32/42332_2.png) [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Post date:** [June 3, 2020, 12:38am UTC](https://discuss.elastic.co/t/linux-ps-command-shows-elasticsearch-password/234621/7 "2020-06-03T00:38:14Z")
If you use a different environment variable name it shouldn't show up in the ps command. The kibana-docker script is designed to look for specific environment variables, ELASTICSEARCH\_PASSWORD is one of them. The script itself comes from here > Good luck ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 1, 2020, 12:41am UTC](https://discuss.elastic.co/t/linux-ps-command-shows-elasticsearch-password/234621/8 "2020-07-01T00:41:51Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.