# Problem with Shield installation

**URL:** <https://discuss.elastic.co/t/problem-with-shield-installation/45225>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [March 23, 2016, 1:36pm UTC](https://discuss.elastic.co/t/problem-with-shield-installation/45225 "2016-03-23T13:36:19Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![pittoch](https://avatars.discourse-cdn.com/v4/letter/p/df788c/32.png) [@pittoch](https://discuss.elastic.co/u/pittoch)\
**Post date:** [March 23, 2016, 1:36pm UTC](https://discuss.elastic.co/t/problem-with-shield-installation/45225/1 "2016-03-23T13:36:19Z")

</div>

Hello,

I encounter a trouble in the Shield installation

My installation is based on

- Kibana-4.4.2-linux-x64
- ElasticSearch 2.2.0
- Shield 2.2.0

I installed:

```
/usr/share/elasticsearch/bin/plugin install file:///data/ELK/sources/plugin-shield/shield-2.2.0.zip

/usr/share/elasticsearch/bin/shield/esusers useradd admin -p mypassword -r admin
/usr/share/elasticsearch/bin/shield/esusers useradd user -p mypassword -r user
/usr/share/elasticsearch/bin/shield/esusers useradd kibana4-server -r kibana4_server -p mypassword

/data/ELK/kibana/bin/kibana plugin -i shield -u file:///data/ELK/sources/plugin-shield/shield-2.2.0.tar.gz

```

The user "user" belongs to the group "user":

```
 ## Read-only operations on indices
 #user:
 # indices:
 # '*':
 # privileges: read

```

I put in

`/etc/elasticsearch/elasticsearch.yml`

```
shield:
  authc:
    realms:
      esusers1:
        type: esusers
        order: 0

shield.audit.enabled: true

```

in  
`/data/ELK/kibana/config/kibana.yml`

```
elasticsearch.username: kibana4-server
elasticsearch.password: mypassword

# SSL for outgoing requests from the Kibana Server to the browser (PEM formatted)
server.ssl.cert: /data/ELK/sslcert/mycert.crt
server.ssl.key: /data/ELK/sslcert/mycert.key

shield.encryptionKey: "mypassphrase"
shield.sessionTimeout: 600000

```

When I open https: [//xx.xx.xx.xx:5600](https://xx.xx.xx.xx:5600)  
I get the login window.  
I can log but I have 2 problems

1. With a user that does not exist I'm logged correctly ... It's very strange!

2. When I connect with the user "user" which belongs to the group "user", I can delete indice. But with the "user" role privileges, it supposed to be refused!

3. http: [//xx.xx.xx.xx:5600](https://xx.xx.xx.xx:5600) is already open. I don't have any login windows to access of elasticsearch web interface

Can you help me ?

Thanks

---

<div class="post-metadata">

**Author:** ![Michael1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michael1/32/29279_2.png) [@Michael1](https://discuss.elastic.co/u/Michael1)\
**Post date:** [March 23, 2016, 5:59pm UTC](https://discuss.elastic.co/t/problem-with-shield-installation/45225/2 "2016-03-23T17:59:21Z")

</div>

I am having the same problem with #1 - I can type anything into the Username/Password box and it get's in every time!!!!

---

<div class="post-metadata">

**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\
**Post date:** [March 23, 2016, 6:24pm UTC](https://discuss.elastic.co/t/problem-with-shield-installation/45225/3 "2016-03-23T18:24:15Z")

</div>

Your `user` role that you show looks like it is commented out, is that accurate?

---

<div class="post-metadata">

**Author:** ![pittoch](https://avatars.discourse-cdn.com/v4/letter/p/df788c/32.png) [@pittoch](https://discuss.elastic.co/u/pittoch)\
**Post date:** [March 23, 2016, 8:19pm UTC](https://discuss.elastic.co/t/problem-with-shield-installation/45225/4 "2016-03-23T20:19:36Z")

</div>

in my file I have no comment on the configuration.

Also, when I open ElasticSearch at xx.xx.xx.xx:9200 , no authentication asked me...

I wonder if my problems are not connected with the fact that I installed just before Marvel with a basic license 1 year .  
Iread somewhere that it disables basic demo license for 30 days of schield or other plugin like watcher. Actually when I look xx.xx.xx : 9200 / \_schield , the plugin does not appear activated.

```
 curl -u es_admin http://127.0.0.1:9200/_shield
{
  "status" : "unlicensed",
  "name" : "node-1",
```

---

<div class="post-metadata">

**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\
**Post date:** [March 23, 2016, 8:33pm UTC](https://discuss.elastic.co/t/problem-with-shield-installation/45225/5 "2016-03-23T20:33:02Z")

</div>

@pittoch Your hunch is correct. A basic license will disable Shield. If you would like to evaluate Shield, you can email [info@elastic.co](mailto:info@elastic.co) to request a trial license that will enable.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:45pm UTC](https://discuss.elastic.co/t/problem-with-shield-installation/45225/6 "2017-07-06T13:45:46Z")

</div>