# Superuser unable to manage xpack security
**URL:** https://discuss.elastic.co/t/superuser-unable-to-manage-xpack-security/124755
**Category:** Elasticsearch
**Created:** [March 20, 2018, 12:13pm UTC](https://discuss.elastic.co/t/superuser-unable-to-manage-xpack-security/124755 "2018-03-20T12:13:21Z")
**Posts on this page:** 15
**Page:** 1
### Author:  [@annk](https://discuss.elastic.co/u/annk)
#### Post date: [March 20, 2018, 12:13pm UTC](https://discuss.elastic.co/t/superuser-unable-to-manage-xpack-security/124755/1 "2018-03-20T12:13:22Z")
I lost the elastic user password since I activated x-pack , I created a new superuser called admin
/bin/x-pack/users list
admin : superuser
now when I access the kibana -\> management -\> security -\> Roles / Users , it shows (logged in as admin)
"You do not have permission to manage roles"
How do I fix this issue ? How do I recover password for elastic user ?
---
### Author:  [@ikakavas](https://discuss.elastic.co/u/ikakavas)
#### Post date: [March 20, 2018, 12:49pm UTC](https://discuss.elastic.co/t/superuser-unable-to-manage-xpack-security/124755/2 "2018-03-20T12:49:20Z")
This should have worked fine. I assume you have used
`bin/x-pack/users useradd admin -r superuser`, correct?
Can you share the output of :
`curl -u admin 'http://localhost:9200/_xpack/security/_authenticate?pretty'`
and
`curl -u admin 'http://localhost:9200` ( so that we can see the version you are running ).
Anything interesting in the elasticsearch logs?
---
### Author:  [@annk](https://discuss.elastic.co/u/annk)
#### Post date: [March 20, 2018, 1:40pm UTC](https://discuss.elastic.co/t/superuser-unable-to-manage-xpack-security/124755/3 "2018-03-20T13:40:23Z")
> [@ikakavas](#):
>
> curl -u admin '[http://localhost:9200/\_xpack/security/\_authenticate?pretty](http://localhost:9200/_xpack/security/_authenticate?pretty)'
{
"username" : "admin",
"roles" : [
"superuser"
],
"full\_name" : null,
"email" : null,
"metadata" : { },
"enabled" : true
}
curl -u admin '[http://localhost:9200](http://localhost:9200)'
{
"name" : "SmUKNKO",
"cluster\_name" : "testenv",
"cluster\_uuid" : "bw7WrLdSROGdtfWbgiauZQ",
"version" : {
"number" : "6.2.2",
"build\_hash" : "10b1edd",
"build\_date" : "2018-02-16T19:01:30.685723Z",
"build\_snapshot" : false,
"lucene\_version" : "7.2.1",
"minimum\_wire\_compatibility\_version" : "5.6.0",
"minimum\_index\_compatibility\_version" : "5.0.0"
},
"tagline" : "You Know, for Search"
}
---
### Author:  [@ikakavas](https://discuss.elastic.co/u/ikakavas)
#### Post date: [March 21, 2018, 5:03am UTC](https://discuss.elastic.co/t/superuser-unable-to-manage-xpack-security/124755/4 "2018-03-21T05:03:32Z")
`superuser` should be allowed to manage roles obviously. Can you please share any part of your elasticsearch logs that might seem relevant ( i.e. logging in via Kibana and accessing the Management tab ).
If nothing interesting is there you can try enabling DEBUG
```auto
PUT /_cluster/settings
{"transient":{"logger.org.elasticsearch.xpack.security.authz": "DEBUG"}}
```
temporarily while performing the action above.
---
### Author:  [@annk](https://discuss.elastic.co/u/annk)
#### Post date: [March 21, 2018, 10:21am UTC](https://discuss.elastic.co/t/superuser-unable-to-manage-xpack-security/124755/5 "2018-03-21T10:21:25Z")
I am not getting any errors in elkcluster\_access.log , all lines shows access\_granted.
But I am getting these errors in elkcluster.log
[ERROR][o.e.x.s.a.e.ReservedRealm] [SmUKNKO] failed to retrieve password hash for reserved user [elastic]
[INFO][o.e.x.s.a.AuthenticationService] [SmUKNKO] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]
[INFO][o.e.x.w.a.l.ExecutableLoggingAction] [SmUKNKO] Watch [Idle\_pct] has exceeded the threshold []
[ERROR][o.e.x.m.c.c.ClusterStatsCollector] [SmUKNKO] collector [cluster\_stats] failed to collect data
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [March 22, 2018, 5:36am UTC](https://discuss.elastic.co/t/superuser-unable-to-manage-xpack-security/124755/6 "2018-03-22T05:36:23Z")
I believe the error you are seeing in Kibana is incorrect.
From what I can see, Kibana will give that error whenever it fails to retrieve the list of available roles from Elasticsearch. So, although it appears to be a permissions problem, it could actually have some other underlying cause.
I believe your cluster (and/or security index) might be suffering from some health issues.
Can you check these:
```auto
curl -uadmin 'http://localhost:9200/_cluster/health?pretty'
```
```auto
curl -uadmin 'http://localhost:9200/.security-6' --head
```
```auto
curl -uadmin 'http://localhost:9200/_cat/shards'
```
---
### Author:  [@annk](https://discuss.elastic.co/u/annk)
#### Post date: [March 22, 2018, 1:27pm UTC](https://discuss.elastic.co/t/superuser-unable-to-manage-xpack-security/124755/7 "2018-03-22T13:27:51Z")
curl -uadmin '[http://localhost:9200/\_cluster/health?pretty](http://localhost:9200/_cluster/health?pretty)'
{
"cluster\_name" : "elk-cluster",
"status" : "yellow",
"timed\_out" : false,
"number\_of\_nodes" : 1,
"number\_of\_data\_nodes" : 1,
"active\_primary\_shards" : 1556,
"active\_shards" : 1556,
"relocating\_shards" : 0,
"initializing\_shards" : 0,
"unassigned\_shards" : 1541,
"delayed\_unassigned\_shards" : 0,
"number\_of\_pending\_tasks" : 0,
"number\_of\_in\_flight\_fetch" : 0,
"task\_max\_waiting\_in\_queue\_millis" : 0,
"active\_shards\_percent\_as\_number" : 50.24216984178237
}
curl -uadmin '[http://localhost:9200/.security-6](http://localhost:9200/.security-6)' --head
HTTP/1.1 404 Not Found
content-type: application/json; charset=UTF-8
content-length: 367
---
### Author:  [@annk](https://discuss.elastic.co/u/annk)
#### Post date: [March 22, 2018, 2:26pm UTC](https://discuss.elastic.co/t/superuser-unable-to-manage-xpack-security/124755/8 "2018-03-22T14:26:35Z")
How do I recover the elastic user password ?
I keep getting the above mentioned error logs on elastic user .
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [March 22, 2018, 11:28pm UTC](https://discuss.elastic.co/t/superuser-unable-to-manage-xpack-security/124755/9 "2018-03-22T23:28:33Z")
> [@annk](#):
>
> How do I recover the elastic user password ?
It doesn't look like the Elastic user has a password yet.
Have you tried running `setup-passwords`?
---
### Author:  [@annk](https://discuss.elastic.co/u/annk)
#### Post date: [March 23, 2018, 2:20pm UTC](https://discuss.elastic.co/t/superuser-unable-to-manage-xpack-security/124755/10 "2018-03-23T14:20:34Z")
I tried, I am getting these errors.
x-pack/setup-passwords interactive
Failed to authenticate user 'elastic' against [http://localhost:9200/\_xpack/security/\_authenticate?pretty](http://localhost:9200/_xpack/security/_authenticate?pretty)
Possible causes include:
- The password for the 'elastic' user has already been changed on this cluster
- Your elasticsearch node is running against a different keystore
This tool used the keystore at /etc/elasticsearch/elasticsearch.keystore
ERROR: Failed to verify bootstrap password
---
### Author:  [@annk](https://discuss.elastic.co/u/annk)
#### Post date: [March 23, 2018, 2:44pm UTC](https://discuss.elastic.co/t/superuser-unable-to-manage-xpack-security/124755/12 "2018-03-23T14:44:18Z")
I also tried to reset elastic user password using this
curl -u my\_admin -XPUT '[http://localhost:9200/\_xpack/security/user/elastic/\_password?pretty](http://localhost:9200/_xpack/security/user/elastic/_password?pretty)' -H 'Content-Type: application/json' -d'
> { "password": "password" }'
{
"error" : {
"root\_cause" : [
{
"type" : "index\_not\_found\_exception",
"reason" : "no such index",
"resource.type" : "index\_or\_alias",
"resource.id" : ".security-6",
"index\_uuid" : "_na_",
"index" : ".security-6"
}
],
"type" : "index\_not\_found\_exception",
"reason" : "no such index",
"resource.type" : "index\_or\_alias",
"resource.id" : ".security-6",
"index\_uuid" : "_na_",
"index" : ".security-6"
},
"status" : 404
}
---
### Author:  [@annk](https://discuss.elastic.co/u/annk)
#### Post date: [March 23, 2018, 2:55pm UTC](https://discuss.elastic.co/t/superuser-unable-to-manage-xpack-security/124755/13 "2018-03-23T14:55:59Z")
I can see an index called .security-v6 but not .security-6.
(sorry about multiple posts, I am not able to edit my previous post )
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [March 23, 2018, 9:28pm UTC](https://discuss.elastic.co/t/superuser-unable-to-manage-xpack-security/124755/14 "2018-03-23T21:28:11Z")
Did you previously run a beta version of Elasticsearch 6.0 on this cluster?
The security index was called `.security-v6` during some of the betas.
---
### Author:  [@annk](https://discuss.elastic.co/u/annk)
#### Post date: [March 26, 2018, 11:54am UTC](https://discuss.elastic.co/t/superuser-unable-to-manage-xpack-security/124755/16 "2018-03-26T11:54:29Z")
Yes , I used 6.1 before upgrading to the latest version.
I was able to fix the issue using index aliases.
curl -XPOST -u my\_admin 'localhost:9200/\_aliases?pretty' -H 'Content-Type: application/json' -d'
{
"actions" : [
{ "add" : { "index" : ".security-v6", "alias" : ".security-6" } }
]
}
'
after this I was able to reset my elastic user password and everything is working now.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 23, 2018, 11:54am UTC](https://discuss.elastic.co/t/superuser-unable-to-manage-xpack-security/124755/17 "2018-04-23T11:54:43Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.