# Xpack security troubles

**URL:** <https://discuss.elastic.co/t/xpack-security-troubles/314594>\
**Category:** Elasticsearch\
**Created:** [September 16, 2022, 5:30pm UTC](https://discuss.elastic.co/t/xpack-security-troubles/314594 "2022-09-16T17:30:58Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mo\_the\_literate](https://avatars.discourse-cdn.com/v4/letter/m/eb8c5e/32.png) [@Mo\_the\_literate](https://discuss.elastic.co/u/Mo_the_literate)\
**Post date:** [September 16, 2022, 5:30pm UTC](https://discuss.elastic.co/t/xpack-security-troubles/314594/1 "2022-09-16T17:30:58Z")

</div>

Hi guys,

I have installed graylog-server 4.3.5-1 on Debian 11.4 as well as elasticsearch 7.17.5

When I run the setup without uncommenting  
`#xpack.security.enabled: true`  
I get these here warnings in logs:

"Elasticsearch built-in security features are not enabled. Without authentication, your cluster could be accessible to anyone. See (link obfuscated) /guide/en/elasticsearch/reference/7.17/security-minimal-setup.html to enable security."]"

So I decided to try to enable xpack security and did the following to try to achieve that:

I uncommented “#xpack.security.enabled: true” in /etc/elasticsearch/elasticsearch.yml

I ran “./bin/elasticsearch-setup-passwords auto” to set passwords for built-in users.

I created the follwing role:

```auto
{
“graylog_role” : {
“cluster” : [
“monitor”,
“manage”,
“all”
],
“indices” : [
{
“names” : [
“*”
],
“privileges” : [
“all”
],
“allow_restricted_indices” : false
}
],
“applications” : ,
“run_as” : ,
“metadata” : { },
“transient_metadata” : {
“enabled” : true
}
}
}

```

and lastly I created the follwing user:

```auto
{
“myelasticuser” : {
“username” : “myelasticuser”,
“roles” : [
“graylog_role”
],
“full_name” : “elastic graylog user”,
“email” : “[emailaddress@example.com](mailto:emailaddress@example.com)”,
“metadata” : {
“intelligence” : 1
},
“enabled” : true
}
}

```

Now I get the follwing in logs:

"ERROR [VersionProbe] Unable to retrieve version from Elasticsearch node 127.0.0.1:9200: Error response: type: security\_exception - reason: action [cluster:monitor/main] is unauthorized for user [myelasticuser] with roles [all,monitor,manage], this action is granted by the cluster privileges [monitor,manage,all]"

and nothing works.

Am I missing a step?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 14, 2022, 5:31pm UTC](https://discuss.elastic.co/t/xpack-security-troubles/314594/2 "2022-10-14T17:31:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.