# Unable to Authenticate user \[kibana\_system\] for REST request
**URL:** https://discuss.elastic.co/t/unable-to-authenticate-user-kibana-system-for-rest-request/317455
**Category:** Kibana
**Tags:** elastic-stack-security
**Created:** [October 26, 2022, 3:13am UTC](https://discuss.elastic.co/t/unable-to-authenticate-user-kibana-system-for-rest-request/317455 "2022-10-26T03:13:14Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Ihms](https://discuss.elastic.co/u/Ihms)
#### Post date: [October 26, 2022, 3:13am UTC](https://discuss.elastic.co/t/unable-to-authenticate-user-kibana-system-for-rest-request/317455/1 "2022-10-26T03:13:14Z")
I have just installed Elasticsearch 8.4. I can successfully connect to Elasticsearch, but when I try connecting to Kibana, I get the below error:
```auto
Unable to retrieve version information from Elasticsearch nodes. security_exception: [security_exception] Reason: unable to authenticate user [kibana_system] for REST request [/_nodes?filter_path=nodes.*.version%2Cnodes.*.http.publish_address%2Cnodes.*.ip]","log":{"level":"ERROR","logger":"elasticsearch-service"}
{"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"8.4.0"},"@timestamp":"2022-10-25T23:52:37.726+00:00","message":"Browser executable: /usr/share/kibana/x-pack/plugins/screenshotting/chromium/headless_shell-linux_x64/headless_shell","log":{"level>
{"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"8.4.0"},"@timestamp":"2022-10-26T00:12:36.205+00:00","message":"Timeout: it took more than 1200000ms","error":{"message":"Timeout: it took more than 1200000ms","type":"Error","stack_trace":"Error>
message":"Failure installing common resources shared between all indices.
```
It says it can't authenticate user Kibana\_system. I followed the documentation for setup. Here's everything I have done:
I configured my elastic.yml as follows:
```auto
cluster.name: testing
node.name: elasticTesting
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
network.host: 0.0.0.0
http.port: 9200
discovery.seed_hosts: []
xpack.security.enabled: true
xpack.security.enrollment.enabled: true
xpack.security.http.ssl:
enabled: true
keystore.path: certs/http.p12
xpack.security.transport.ssl:
enabled: true
verification_mode: certificate
keystore.path: certs/transport.p12
truststore.path: certs/transport.p12
cluster.initial_master_nodes: ["elasticTesting"]
http.host: 0.0.0.0
```
I reset the Kibana user password to `changeme` by running `/usr/share/elasticsearch/bin/elasticsearch-reset-password -i -u kibana_system`
I then configured my `kibana.yml` as follows:
```auto
server.port: 5601
server.host:"10.0.4.23"
server.publicBaseUrl: "http://10.0.4.23:5601"
elasticsearch.hosts: ["https://10.0.4.23:9200 "]
elasticsearch.username: "kibana_system"
elasticsearch.password: "changeme"
elasticsearch.ssl.certificateAuthorities: ["/etc/kibana/certs/http_ca.crt"]
logging:
appenders:
file:
type: file
fileName: /var/log/kibana/kibana.log
layout:
type: json
root:
appenders:
- default
- file
pid.file: /run/kibana/kibana.pid
```
Any ideas on how I can fix these?
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [October 26, 2022, 3:52am UTC](https://discuss.elastic.co/t/unable-to-authenticate-user-kibana-system-for-rest-request/317455/2 "2022-10-26T03:52:48Z")
> [@Ihms](#):
>
> ```auto
> elasticsearch.username: "kibana_system"
>
> elasticsearch.password: "changeme"
>
> ```
Can you curl Elasticsearch with these details and post the output?
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [October 26, 2022, 5:00am UTC](https://discuss.elastic.co/t/unable-to-authenticate-user-kibana-system-for-rest-request/317455/4 "2022-10-26T05:00:22Z")
The `kibana_system` user is not intended as a UI user and it only to allow Kibana to connect to Elasticsearch, you need another one.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 23, 2022, 5:01am UTC](https://discuss.elastic.co/t/unable-to-authenticate-user-kibana-system-for-rest-request/317455/5 "2022-11-23T05:01:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.