# Securing Elasticsearch and Kibana with SSL and username and password
**URL:** https://discuss.elastic.co/t/securing-elasticsearch-and-kibana-with-ssl-and-username-and-password/184873
**Category:** Kibana
**Tags:** elastic-stack-security
**Created:** [June 9, 2019, 10:02am UTC](https://discuss.elastic.co/t/securing-elasticsearch-and-kibana-with-ssl-and-username-and-password/184873 "2019-06-09T10:02:49Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@jkara](https://discuss.elastic.co/u/jkara)
#### Post date: [June 9, 2019, 10:02am UTC](https://discuss.elastic.co/t/securing-elasticsearch-and-kibana-with-ssl-and-username-and-password/184873/1 "2019-06-09T10:02:49Z")
Good evening to all,
I have installed Elasticsearch and Kibana on a Centos 7 Virtual Machine.
I have successfully enabled SSL encryption (HTTPS) but although I would also like to enable access to the Kibana GUI only to authenticated users....
If I understand these posts correctly:
- [Security for Elasticsearch is now free](https://www.elastic.co/blog/security-for-elasticsearch-is-now-free)
- [Getting started with Elasticsearch security](https://www.elastic.co/blog/getting-started-with-elasticsearch-security)
I can use the free (Basic) version to:
- TLS for encrypted communications
- File and native realm for creating and managing users
- Role-based access control for controlling user access to cluster APIs and indexes; also allows multi-tenancy for Kibana with security for Kibana Spaces
TLS encryption of Kibana was easy enough to enable, but I cannot setup authentication...
Am I doing something wrong?
Have I not understood something?
I tried following the instructions, but get an error when creating passwords
_ **/usr/share/elasticsearch/bin/elasticsearch-setup-passwords auto** _
```
Unexpected response code [500] from calling GET http://127.0.0.1:9200/_security/_authenticate?pretty
It doesn't look like the X-Pack security feature is enabled on this Elasticsearch node.
Please check if you have enabled X-Pack security in your elasticsearch.yml configuration file.
emphasized text
ERROR: X-Pack Security is disabled by configuration.
```
Do I need to install X-Pack, to be able to use RBAC, user name and password authentication?
thank you for your time.
Jacob
```
# yum list installed | grep elastic
elasticsearch.x86_64 7.1.1-1 @elasticsearch-7.x
kibana.x86_64 7.1.1-1 @elasticsearch-7.x
# curl -XGET http://127.0.0.1:9200
{
"name" : "elasticsearch.myhome.net",
"cluster_name" : "elasticsearch",
"cluster_uuid" : "XYZ_123_ZYX_something_else_here",
"version" : {
"number" : "7.1.1",
"build_flavor" : "default",
"build_type" : "rpm",
"build_hash" : "7a013de",
"build_date" : "2019-05-23T14:04:00.380842Z",
"build_snapshot" : false,
"lucene_version" : "8.0.0",
"minimum_wire_compatibility_version" : "6.8.0",
"minimum_index_compatibility_version" : "6.0.0-beta1"
},
"tagline" : "You Know, for Search"
}
netstat -tulpn
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
**tcp 0 0 127.0.0.1:9200 0.0.0.0:* LISTEN 3495/java**
**tcp 0 0 127.0.0.1:9300 0.0.0.0:* LISTEN 3495/java**
**tcp 0 0 0.0.0.0:5601 0.0.0.0:* LISTEN 2904/node**
cat /etc/kibana/kibana.yml
# Kibana is served by a back end server. This setting specifies the port to use.
server.port: 5601
#server.port: 443
# Specifies the address to which the Kibana server will bind. IP addresses and host names are both valid values.
# The default is 'localhost', which usually means remote machines will not be able to connect.
# To allow connections from remote users, set this parameter to a non-loopback address.
#server.host: "localhost"
server.host: "0.0.0.0"
# The Kibana server's name. This is used for display purposes.
server.name: "Elastic SIEM"
# The URLs of the Elasticsearch instances to use for all your queries.
#elasticsearch.hosts: ["http://localhost:9200"]
# When this setting's value is true Kibana uses the hostname specified in the server.host
# setting. When the value of this setting is false, Kibana uses the hostname of the host
# that connects to this Kibana instance.
#elasticsearch.preserveHost: true
# Kibana uses an index in Elasticsearch to store saved searches, visualizations and
# dashboards. Kibana creates a new index if the index doesn't already exist.
#kibana.index: ".kibana"
# The default application to load.
#kibana.defaultAppId: "home"
# If your Elasticsearch is protected with basic authentication, these settings provide
# the username and password that the Kibana server uses to perform maintenance on the Kibana
# index at startup. Your Kibana users still need to authenticate with Elasticsearch, which
# is proxied through the Kibana server.
elasticsearch.username: "kibana"
elasticsearch.password: "myPass123"
# Enables SSL and paths to the PEM-format SSL certificate and SSL key files, respectively.
# These settings enable SSL for outgoing requests from the Kibana server to the browser.
server.ssl.enabled: true
server.ssl.certificate: /etc/pki/tls/certs/mysiem.edu.gr.crt
server.ssl.key: /etc/pki/tls/private/mysiem.edu.gr.key
```
---
### Author:  [@jbudz](https://discuss.elastic.co/u/jbudz)
#### Post date: [June 10, 2019, 12:53pm UTC](https://discuss.elastic.co/t/securing-elasticsearch-and-kibana-with-ssl-and-username-and-password/184873/2 "2019-06-10T12:53:55Z")
Hey you got it - you'll want the distrbution with x-pack. The basic license will enable a subset of features.
The "default" distribution that blog article refers is everything, and the oss distribution would be without x-pack
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [June 11, 2019, 1:27am UTC](https://discuss.elastic.co/t/securing-elasticsearch-and-kibana-with-ssl-and-username-and-password/184873/3 "2019-06-11T01:27:19Z")
> [@jkara](#):
>
> ERROR: X-Pack Security is disabled by configuration.
You need to explicitly enable security in Elasticsearch.
Per step 1 of the blog you referenced:
```auto
xpack.security.enabled: true
```
Following the [full tutorial](https://www.elastic.co/guide/en/elastic-stack-overview/7.1/get-started-enable-security.html) may be more helpful than replicating the steps in blog.
---
### Author:  [@jkara](https://discuss.elastic.co/u/jkara)
#### Post date: [June 12, 2019, 8:47am UTC](https://discuss.elastic.co/t/securing-elasticsearch-and-kibana-with-ssl-and-username-and-password/184873/4 "2019-06-12T08:47:38Z")
Dear Jon and _Tim_,
thank you for your prompt responses.
In my case (Elasticsearch installed using the yum repo), the configuration file was at: _/etc/elasticsearch/elasticsearch.yml_
I added the configuration options, you suggested, and as you pointed out, were mentioned in the manual:
xpack.security.enabled: true
discovery.type: single-node
The blog post I followed, said something about out of the box functionality that was now _free_ without enabling paid features (in my mind x-pack), and therefore I would not thing that I should have to explicitly enable X-Pack first.
Thank you again for your help.
Greetings from Greece.
Jacob
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 10, 2019, 8:47am UTC](https://discuss.elastic.co/t/securing-elasticsearch-and-kibana-with-ssl-and-username-and-password/184873/5 "2019-07-10T08:47:43Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.