Socket Hang Up Error with Kibana Login

I've been getting a "Socket Hang Up" error when trying to launch Kibana and could use some help troubleshooting the cause. Some background context:

  • My employer requires their own CA, so I had to setup Kibana manually without using an enrollment token. Reference
  • Kibana and Elasticsearch are on separate servers, and I can curl successfully to Elasticsearch from the Kibana machine with service tokens or username/password
  • Kibana launches, but I can't login with any of the users

What I think is happening is an SSL problem preventing Kibana from talking to Elasticsearch, which in turn means Kibana can't verify any users, which means no one can login. Does that seem correct? Error log is below

Jun 28 15:59:01 my-hostname kibana[518982]: [2023-06-28T15:59:01.537-04:00][DEBUG][plugins.licensing] Requesting Elasticsearch licensing API
Jun 28 15:59:01 my-hostname kibana[518982]: [2023-06-28T15:59:01.542-04:00][DEBUG][elasticsearch.query.data] 200 - 1.3KB
Jun 28 15:59:01 my-hostname kibana[518982]: GET /_xpack
Jun 28 15:59:01 my-hostname kibana[518982]: [2023-06-28T15:59:01.545-04:00][DEBUG][http.server.response] POST /internal/security/login 401 79ms - 123.0B
Jun 28 15:59:02 my-hostname kibana[518982]: [2023-06-28T15:59:02.875-04:00][DEBUG][execution_context] {"type":"application","name":"security_login","url":"/login"}
Jun 28 15:59:02 my-hostname kibana[518982]: [2023-06-28T15:59:02.886-04:00][INFO ][plugins.security.routes] Logging in with provider "basic" (basic)
Jun 28 15:59:02 my-hostname kibana[518982]: [2023-06-28T15:59:02.886-04:00][DEBUG][http.server.Kibana.cookie-session-storage] Error: Unauthorized
Jun 28 15:59:02 my-hostname kibana[518982]: [2023-06-28T15:59:02.887-04:00][DEBUG][plugins.security.basic.basic] Trying to perform a login.
Jun 28 15:59:02 my-hostname kibana[518982]: [2023-06-28T15:59:02.941-04:00][DEBUG][elasticsearch.query.data] [ConnectionError]: socket hang up - Local: my-kibana-IP:39946, Remote: my-elasticsearch-IP:9200
1 Like

Elasticsearch logs gave far more descriptive errors, and pointed out it was a client certificate issue. I used this post for reference. https://discuss.elastic.co/t/elasticsearch-kibana-mutual-tls-authentication-empty-client-certificate-chain/305954

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.