# Locked Out of Kibana Superuser Can't Modify Index Settings
**URL:** https://discuss.elastic.co/t/locked-out-of-kibana-superuser-cant-modify-index-settings/311424
**Category:** Kibana
**Created:** [August 4, 2022, 1:19pm UTC](https://discuss.elastic.co/t/locked-out-of-kibana-superuser-cant-modify-index-settings/311424 "2022-08-04T13:19:54Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@bjmaynard01](https://discuss.elastic.co/u/bjmaynard01)
#### Post date: [August 4, 2022, 1:19pm UTC](https://discuss.elastic.co/t/locked-out-of-kibana-superuser-cant-modify-index-settings/311424/1 "2022-08-04T13:19:54Z")
I have a single node ELK instance that I am using for a pilot, and the .kibana\_security\_session\_1 index has index.blocks.read\_only\_allow\_delete set to true due to running low on disk space. I have tuned the setting to be more appropriate for my build, but the index is still locked. When I try to flip this to null with a superuser account I get the error `"security_exception","reason":"action [indices:admin/settings/update] is unauthorized for user [xxxxxxxx] with roles [superuser] on restricted indices`. I don't have access to Kibana to create a new role and map my user account to it that does include the permissions necessary. Is there a way to allow this from the API? I'm fairly comfortable interacting with the node via curl, but I have not been able to find a way to use curl to fix this problem.
---
### Author:  [@bjmaynard01](https://discuss.elastic.co/u/bjmaynard01)
#### Post date: [August 5, 2022, 2:18pm UTC](https://discuss.elastic.co/t/locked-out-of-kibana-superuser-cant-modify-index-settings/311424/2 "2022-08-05T14:18:50Z")
To add to this, I have attempted to create a role using the API that included access to restricted indices, however sine the kibana security index is the one that is locked, I can't add a role with the permissions necessary to make the change to unlock it. Really unsure where to go from here.
---
### Author:  [@rashmi](https://discuss.elastic.co/u/rashmi)
#### Post date: [August 5, 2022, 2:33pm UTC](https://discuss.elastic.co/t/locked-out-of-kibana-superuser-cant-modify-index-settings/311424/3 "2022-08-05T14:33:37Z")
> [@bjmaynard01](#):
>
> index.blocks.read\_only\_allow\_delete set to true due to running low on disk space.
As you see from the last line, this index block must be manually released once you have full control of your cluster, with sufficient disc space on all nodes. You can remove the index block with the command listed in the documentation, something like this:
> PUT /my\_index/\_settings
> {
> "index.blocks.read\_only\_allow\_delete": null
> }
Give that a try, also copying @Larry_Gregory for more inputs on this ..they will answer when they get to it .
Thanks
Rashmi
---
### Author:  [@bjmaynard01](https://discuss.elastic.co/u/bjmaynard01)
#### Post date: [August 5, 2022, 2:52pm UTC](https://discuss.elastic.co/t/locked-out-of-kibana-superuser-cant-modify-index-settings/311424/4 "2022-08-05T14:52:18Z")
Thanks for the response, when I attempt that, I get the below output:
```auto
curl --cacert /etc/elasticsearch/certs/http_ca.crt -u maynardbj.sa -X PUT "https://localhost:9200/.kibana_security_session_1/_settings?pretty" -H 'Content-Type: application/json' -d '{ "index.blocks.read_only_allow_delete": null }'
Enter host password for user 'xxxxxxxx':
{
"error" : {
"root_cause" : [
{
"type" : "security_exception",
"reason" : "action [indices:admin/settings/update] is unauthorized for user [xxxxxxxx] with roles [superuser] on restricted indices [.kibana_security_session_1], this action is granted by the index privileges [manage,all]"
}
],
"type" : "security_exception",
"reason" : "action [indices:admin/settings/update] is unauthorized for user [xxxxxxxx] with roles [superuser] on restricted indices [.kibana_security_session_1], this action is granted by the index privileges [manage,all]"
},
"status" : 403
}
```
When I get the output for the privileges for my 'superuser' role, I get the below output:
```auto
{
"superuser" : {
"cluster" : [
"all"
],
"indices" : [
{
"names" : [
"*"
],
"privileges" : [
"all"
],
"allow_restricted_indices" : false
},
{
"names" : [
"*"
],
"privileges" : [
"monitor",
"read",
"view_index_metadata",
"read_cross_cluster"
],
"allow_restricted_indices" : true
}
],
"applications" : [
{
"application" : "*",
"privileges" : [
"*"
],
"resources" : [
"*"
]
}
],
"run_as" : [
"*"
],
"metadata" : {
"_reserved" : true
},
"transient_metadata" : { }
}
}
```
So I have the 'all' privilege on all indices as stated by the error above, but I do not have the allow\_restricted\_indices set to true for indices. I have tried creating another role with the all and manage and setting this to true, but with the kibana security index locked, it won't allow the creation of a new role.
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [August 5, 2022, 3:56pm UTC](https://discuss.elastic.co/t/locked-out-of-kibana-superuser-cant-modify-index-settings/311424/5 "2022-08-05T15:56:28Z")
@bjmaynard01 Have you reduced / cleaned up the disk to be below all the thresholds / watermarks?
I ask because I believe recently elastics should be removing those blocks automatically when the disk is below all the watermarks.
2nd is see this in your role
```
"allow_restricted_indices" : false
```
the index you are trying to access is a restricted index.
---
### Author:  [@bjmaynard01](https://discuss.elastic.co/u/bjmaynard01)
#### Post date: [August 8, 2022, 1:02pm UTC](https://discuss.elastic.co/t/locked-out-of-kibana-superuser-cant-modify-index-settings/311424/7 "2022-08-08T13:02:33Z")
You were correct, once I removed enough indexes to get back down below the watermark and restarted everything, I was back in. Thank you.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 5, 2022, 1:03pm UTC](https://discuss.elastic.co/t/locked-out-of-kibana-superuser-cant-modify-index-settings/311424/8 "2022-09-05T13:03:12Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.