# X-Pack Authentication Plugin **URL:** \ **Category:** Elasticsearch\ **Created:** [November 3, 2017, 7:07pm UTC](https://discuss.elastic.co/t/x-pack-authentication-plugin/106355 "2017-11-03T19:07:16Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![mathurin68](https://avatars.discourse-cdn.com/v4/letter/m/6bbea6/32.png) [@mathurin68](https://discuss.elastic.co/u/mathurin68)\ **Post date:** [November 3, 2017, 7:07pm UTC](https://discuss.elastic.co/t/x-pack-authentication-plugin/106355/1 "2017-11-03T19:07:16Z")
I installed x-pack - followed everything here, changing passwords, etc - [https://www.elastic.co/guide/en/x-pack/current/security-getting-started.html](https://www.elastic.co/guide/en/x-pack/current/security-getting-started.html) Changed all the passwords to new elastic password. Made sure correct user was owner in all folders i.e. kibana:kibana in /usr/share/kibana And I can login with new elastic password - curl -u elastic:newpassword [http://localhost:9200](http://localhost:9200) { "name" : "qrSYXO4", "cluster\_name" : "elasticsearch", "cluster\_uuid" : "IVS7Fb\_fQ3mGxFbyqfM-NQ", "version" : { "number" : "5.6.3", "build\_hash" : "1a2f265", "build\_date" : "2017-10-06T20:33:39.012Z", "build\_snapshot" : false, "lucene\_version" : "6.6.1" }, "tagline" : "You Know, for Search" } But I can't login to kibana with elastic and newpassword I tried curl -u kibana:newpassword [http://localhost:5601](http://localhost:5601) I've even added username password to kibana.yml and when I checked the logs - [2017-11-03T14:57:17,783][WARN][o.e.x.s.a.AuthenticationService] [qrSYXO4] An error occurred while attempting to authenticate [logstash\_system] against realm [reserved] - ElasticsearchSecurityException[failed to authenticate user [logstash\_system]] [2017-11-03T14:57:17,987][WARN][o.e.x.s.a.AuthenticationService] [qrSYXO4] An error occurred while attempting to authenticate [logstash\_system] against realm [reserved] - ElasticsearchSecurityException[failed to authenticate user [logstash\_system]] Anything else I can try? Thanks! ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [November 6, 2017, 3:58pm UTC](https://discuss.elastic.co/t/x-pack-authentication-plugin/106355/2 "2017-11-06T15:58:52Z")
Hi Matt, The logs you have shared indicate that the login failure happens for the user `logstash_system` and not `kibana` which is the one you attempt to authenticate to kibana with. For the logstash issue: - Have you changed the default password ? - Have you added this to the `logstash.yml` configuration file ? - Have you [disabled default password support](https://www.elastic.co/guide/en/x-pack/current/setting-up-authentication.html#disabling-default-password) ? as suggested [here](https://www.elastic.co/guide/en/x-pack/current/setting-up-authentication.html#reset-built-in-user-passwords) ? For the Kibana issue, can you please retry to authenticate and share the relevant log entries? ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [November 6, 2017, 11:26pm UTC](https://discuss.elastic.co/t/x-pack-authentication-plugin/106355/3 "2017-11-06T23:26:33Z")
> [@mathurin68](#): > > curl -u kibana:newpassword [http://localhost:5601](http://localhost:5601) This is not intended to work. The `kibana` user is the user that _Kibana_ uses to access Elasticsearch, not a user that you should use to login to Kibana. Our recommended approach is that you - Configure kibana (`kibana.yml`) to use the `kibana` user and password for accessing ES. - Login to Kibana (using a browser) using the `elastic` user (which is a superuser) - Using that superuser, create a new low-privilege user for accessing Kibana, and then use that new user for future Kibana access. Details are here: [Kibana and Security | X-Pack for the Elastic Stack [5.6] | Elastic](https://www.elastic.co/guide/en/x-pack/5.6/kibana.html) ---
**Author:** ![mathurin68](https://avatars.discourse-cdn.com/v4/letter/m/6bbea6/32.png) [@mathurin68](https://discuss.elastic.co/u/mathurin68)\ **Post date:** [November 7, 2017, 7:18pm UTC](https://discuss.elastic.co/t/x-pack-authentication-plugin/106355/4 "2017-11-07T19:18:07Z")
Alright got it but now getting totally new error - [logstash.outputs.elasticsearch] Encountered a retryable error. Will Retry with exponential backoff {:code=\>403, :url=\>"[http://10.68.168.21:9200/\_bulk](http://10.68.168.21:9200/_bulk)"} I'll start a new question. Thanks!! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 5, 2017, 7:18pm UTC](https://discuss.elastic.co/t/x-pack-authentication-plugin/106355/5 "2017-12-05T19:18:25Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.