# Security Exception against elastic user
**URL:** https://discuss.elastic.co/t/security-exception-against-elastic-user/114252
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [January 5, 2018, 9:47am UTC](https://discuss.elastic.co/t/security-exception-against-elastic-user/114252 "2018-01-05T09:47:42Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@4b3l](https://discuss.elastic.co/u/4b3l)
#### Post date: [January 5, 2018, 9:47am UTC](https://discuss.elastic.co/t/security-exception-against-elastic-user/114252/1 "2018-01-05T09:47:42Z")
I have an 3 node ES Cluster (version 5.6.3). I have deleted the data from each Node and tried to bring up the cluster (as I am still experimenting with the cluster, the data is not important).
I get the below error:
[2018-01-05T09:41:26,410][ERROR][o.e.x.s.a.e.ReservedRealm] [c2-5a-c1-c2-d3-93] failed to retrieve password hash for reserved user [elastic]
[2018-01-05T09:41:26,411][WARN][o.e.x.s.a.AuthenticationService] [c2-5a-c1-c2-d3-93] An error occurred while attempting to authenticate [elastic] against realm [reserved] - ElasticsearchSecurityException[failed to authenticate user [elastic]]
How can I fix this? With the data deleted, I would have thought this would been seen as a clean cluster?
I can't seem to amend the elastic user password through ../bin/x-pack/users command as it is a reserved user. It seems the password is corrupt? How can I reset this?
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [January 9, 2018, 2:53am UTC](https://discuss.elastic.co/t/security-exception-against-elastic-user/114252/2 "2018-01-09T02:53:44Z")
> [@4b3l](#):
>
> I have deleted the data from each Node
How did you delete the data?
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [January 9, 2018, 3:47am UTC](https://discuss.elastic.co/t/security-exception-against-elastic-user/114252/3 "2018-01-09T03:47:04Z")
> [@4b3l](#):
>
> [2018-01-05T09:41:26,410][ERROR][o.e.x.s.a.e.ReservedRealm] [c2-5a-c1-c2-d3-93] failed to retrieve password hash for reserved user [elastic]
There should be more context to this error message. The code that produces this error also reports on the problem that caused it. Can you check your logs to see if there is additional information?
---
### Author:  [@4b3l](https://discuss.elastic.co/u/4b3l)
#### Post date: [January 15, 2018, 4:39pm UTC](https://discuss.elastic.co/t/security-exception-against-elastic-user/114252/4 "2018-01-15T16:39:38Z")
I deleted the data by shutting down all the ES Nodes and then delete the data folder.
---
### Author:  [@4b3l](https://discuss.elastic.co/u/4b3l)
#### Post date: [January 15, 2018, 4:50pm UTC](https://discuss.elastic.co/t/security-exception-against-elastic-user/114252/6 "2018-01-15T16:50:41Z")
The logs are only filled with single line WARN messages.
To get around the issue I had to create a new SuperUser, by running the /usr/share/elasticsearch/bin/x-pack/users command.
But the default user should have worked for me.
---
### Author:  [@ikakavas](https://discuss.elastic.co/u/ikakavas)
#### Post date: [January 15, 2018, 5:07pm UTC](https://discuss.elastic.co/t/security-exception-against-elastic-user/114252/7 "2018-01-15T17:07:25Z")
Hi,
This [introduction](https://www.elastic.co/guide/en/x-pack/5.6/how-security-works.html) on how security works for the Elastic stack might be helpful. Also, [this page from our documentation](https://www.elastic.co/guide/en/x-pack/5.6/setting-up-authentication.html#built-in-users) would help explain that by deleting all the indices (deleting the data dir), you deleted the `.security` index too, that's where builtin users are stored and this is why you can't use them anymore.
Running the `users` command, you created new a super user in the [File Realm](https://www.elastic.co/guide/en/x-pack/5.6/file-realm.html)
---
### Author:  [@4b3l](https://discuss.elastic.co/u/4b3l)
#### Post date: [January 16, 2018, 2:34pm UTC](https://discuss.elastic.co/t/security-exception-against-elastic-user/114252/8 "2018-01-16T14:34:13Z")
Hi Thanks for your reply. but if I had reprovision the VMs. This means the environment has been reset back to the default? The data folder would be recreated by ES as per the elasticsearch.yml.
This is where my confusion is. I thought resetting the entire environment should mean I would be back to square one.
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [January 16, 2018, 7:49pm UTC](https://discuss.elastic.co/t/security-exception-against-elastic-user/114252/9 "2018-01-16T19:49:18Z")
> [@4b3l](#):
>
> I deleted the data by shutting down all the ES Nodes and then delete the data folder.
> [@4b3l](#):
>
> I had reprovision the VMs. This means the environment has been reset back to the default? The data folder would be recreated by ES as per the elasticsearch.yml.
Then use the APIs, don't just delete things from the filesystem like that.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 13, 2018, 7:49pm UTC](https://discuss.elastic.co/t/security-exception-against-elastic-user/114252/10 "2018-02-13T19:49:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.