# Can not use the Search Guard configuration GUI for privilege management of kibana

**URL:** <https://forum.search-guard.com/t/can-not-use-the-search-guard-configuration-gui-for-privilege-management-of-kibana/772>\
**Category:** Search Guard\
**Created:** [February 1, 2018, 11:50am UTC](https://forum.search-guard.com/t/can-not-use-the-search-guard-configuration-gui-for-privilege-management-of-kibana/772 "2018-02-01T11:50:59Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mu\_piko](https://avatars.discourse-cdn.com/v4/letter/m/b3f665/32.png) [@mu\_piko](https://forum.search-guard.com/u/mu_piko)\
**Post date:** [February 1, 2018, 11:50am UTC](https://forum.search-guard.com/t/can-not-use-the-search-guard-configuration-gui-for-privilege-management-of-kibana/772/1 "2018-02-01T11:50:59Z")

</div>

When asking questions, please provide the following information:

- Search Guard and Elasticsearch version

6.0.0

- Installed and used enterprise modules, if any

not enterprise

- JVM version and operating system version

CentOS Linux release 7.4.1708 (Core)

openjdk version “1.8.0\_151”

- Search Guard configuration files

- Elasticsearch log messages on debug level

- Other installed Elasticsearch or Kibana plugins, if any

pluigins:

analysis-icu

search-guard-6

and

Kibana

## problem

I set it according to the following URL, but the Search Guard menu does not appear.

[LINK](http://docs.search-guard.com/latest/configuration-gui)

## State

All indexes on all nodes, replica is in green state.

Both Elasticsearch and Kibana can operate with SSL connection.

All the settings are attached.

## Doubt

Is it correct that `searchguard` index is empty even if you run` sgadmin.sh`?

# /usr/share/elasticsearch/plugins/search-guard-6/tools/sgadmin.sh -cd /usr/share/elasticsearch/plugins/search-guard-6/sgconfig -icl -nhnv -cacert /etc/elasticsearch/chain-ca.pem -cert /etc/elasticsearch/sgadmin.crtfull.pem -key /etc/elasticsearch/sgadmin.key.pem

Search Guard Admin v6

Will connect to localhost:9300 … done

Connected as CN=sgadmin,OU=System Solution,O=Misou System,L=Sumida,ST=Tokyo,C=JP

Contacting elasticsearch cluster ‘elasticsearch’ and wait for YELLOW clusterstate …

Clustername: mimail-cluster

Clusterstate: GREEN

Number of nodes: 3

Number of data nodes: 3

searchguard index does not exists, attempt to create it … done (auto expand replicas is on)

Populate config from /usr/share/elasticsearch/plugins/search-guard-6/sgconfig/

Will update ‘config’ with /usr/share/elasticsearch/plugins/search-guard-6/sgconfig/sg\_config.yml

SUCC: Configuration for ‘config’ created or updated

Will update ‘roles’ with /usr/share/elasticsearch/plugins/search-guard-6/sgconfig/sg\_roles.yml

SUCC: Configuration for ‘roles’ created or updated

Will update ‘rolesmapping’ with /usr/share/elasticsearch/plugins/search-guard-6/sgconfig/sg\_roles\_mapping.yml

SUCC: Configuration for ‘rolesmapping’ created or updated

Will update ‘internalusers’ with /usr/share/elasticsearch/plugins/search-guard-6/sgconfig/sg\_internal\_users.yml

SUCC: Configuration for ‘internalusers’ created or updated

Will update ‘actiongroups’ with /usr/share/elasticsearch/plugins/search-guard-6/sgconfig/sg\_action\_groups.yml

SUCC: Configuration for ‘actiongroups’ created or updated

Done with success

``

get searchguard/\_search

{

“took”: 1,

“timed\_out”: false,

“\_shards”: {

“total”: 1,

“successful”: 1,

“skipped”: 0,

“failed”: 0

},

“hits”: {

“total”: 0,

“max\_score”: null,

“hits”:

}

}

``

[elasticsearch.yml\_node3](https://cdck-file-uploads-us1.s3.dualstack.us-west-2.amazonaws.com/flex019/uploads/search_guard/original/1X/b4fc72726e7fb51567355545c08afd3e00666d26.yml_node3) (3.77 KB)

[elasticsearch.yml\_node1](https://cdck-file-uploads-us1.s3.dualstack.us-west-2.amazonaws.com/flex019/uploads/search_guard/original/1X/cee9a59c1daaddaa0ce8f82658fe33a235b68c73.yml_node1) (3.77 KB)

[elasticsearch.yml\_node2](https://cdck-file-uploads-us1.s3.dualstack.us-west-2.amazonaws.com/flex019/uploads/search_guard/original/1X/9a879d2e0a674792e0d7f76b2955c3dc8271aa8d.yml_node2) (3.77 KB)

[gen\_client\_node\_cert.sh](https://forum.search-guard.com/uploads/short-url/yEv2WVGaCuWAFw96yfcXiOZSt2h.sh) (2.25 KB)

[gen\_node\_cert\_openssl.sh](https://forum.search-guard.com/uploads/short-url/gdQ1C7ZljW0aiUyPIA80mlromGC.sh) (1.75 KB)

[gen\_root\_ca.sh](https://forum.search-guard.com/uploads/short-url/AgIgLqOnqV5jrVmGqsovAQx4IN4.sh) (1.95 KB)

[example.sh](https://forum.search-guard.com/uploads/short-url/sqjQ6sgBfI8DuoApPXSuGd9iLr8.sh) (1.7 KB)

[kibana.yml](https://forum.search-guard.com/uploads/short-url/ypw8Rm7xuHApPRXSEYZ8BoUZjTs.yml) (4.95 KB)

---

<div class="post-metadata">

**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\
**Post date:** [February 1, 2018, 10:15pm UTC](https://forum.search-guard.com/t/can-not-use-the-search-guard-configuration-gui-for-privilege-management-of-kibana/772/2 "2018-02-01T22:15:53Z")

</div>

Yes, the searchguard index contains sensitive information, so you can view and edit it’s contents only if you provide an admin certificate with your request.

As to your issue, you are running the community edition of Search Guard:

searchguard.enterprise\_modules\_enabled: false

The Config GUI is an enterprise features because it relies on the REST API. We should make that clearer in the docs though.

> **···**
>
> On Thursday, February 1, 2018 at 12:50:59 PM UTC+1, mu piko wrote:
> 
> > When asking questions, please provide the following information:
> 
> > - Search Guard and Elasticsearch version
> 
> > 6.0.0
> 
> > 
> 
> > - Installed and used enterprise modules, if any
> 
> > not enterprise
> 
> > 
> 
> > - JVM version and operating system version
> 
> > CentOS Linux release 7.4.1708 (Core)
> 
> > openjdk version “1.8.0\_151”
> 
> > 
> 
> > - Search Guard configuration files
> 
> > - Elasticsearch log messages on debug level
> 
> > - Other installed Elasticsearch or Kibana plugins, if any
> 
> > pluigins:
> 
> > analysis-icu
> 
> > search-guard-6
> 
> > and
> 
> > Kibana
> 
> > 
> 
> > 
> 
> > ## problem
> 
> > 
> 
> > I set it according to the following URL, but the Search Guard menu does not appear.
> 
> > [LINK](http://docs.search-guard.com/latest/configuration-gui)
> 
> > 
> 
> > ## State
> 
> > 
> 
> > All indexes on all nodes, replica is in green state.
> 
> > Both Elasticsearch and Kibana can operate with SSL connection.
> 
> > All the settings are attached.
> 
> > 
> 
> > ## Doubt
> 
> > 
> 
> > Is it correct that `searchguard` index is empty even if you run` sgadmin.sh`?
> 
> > 
> 
> > # /usr/share/elasticsearch/plugins/search-guard-6/tools/sgadmin.sh -cd /usr/share/elasticsearch/plugins/search-guard-6/sgconfig -icl -nhnv -cacert /etc/elasticsearch/chain-ca.pem -cert /etc/elasticsearch/sgadmin.crtfull.pem -key /etc/elasticsearch/sgadmin.key.pem
> 
> > Search Guard Admin v6
> 
> > Will connect to localhost:9300 … done
> 
> > Connected as CN=sgadmin,OU=System Solution,O=Misou System,L=Sumida,ST=Tokyo,C=JP
> 
> > Contacting elasticsearch cluster ‘elasticsearch’ and wait for YELLOW clusterstate …
> 
> > Clustername: mimail-cluster
> 
> > Clusterstate: GREEN
> 
> > Number of nodes: 3
> 
> > Number of data nodes: 3
> 
> > searchguard index does not exists, attempt to create it … done (auto expand replicas is on)
> 
> > Populate config from /usr/share/elasticsearch/plugins/search-guard-6/sgconfig/
> 
> > Will update ‘config’ with /usr/share/elasticsearch/plugins/search-guard-6/sgconfig/sg\_config.yml
> 
> > SUCC: Configuration for ‘config’ created or updated
> 
> > Will update ‘roles’ with /usr/share/elasticsearch/plugins/search-guard-6/sgconfig/sg\_roles.yml
> 
> > SUCC: Configuration for ‘roles’ created or updated
> 
> > Will update ‘rolesmapping’ with /usr/share/elasticsearch/plugins/search-guard-6/sgconfig/sg\_roles\_mapping.yml
> 
> > SUCC: Configuration for ‘rolesmapping’ created or updated
> 
> > Will update ‘internalusers’ with /usr/share/elasticsearch/plugins/search-guard-6/sgconfig/sg\_internal\_users.yml
> 
> > SUCC: Configuration for ‘internalusers’ created or updated
> 
> > Will update ‘actiongroups’ with /usr/share/elasticsearch/plugins/search-guard-6/sgconfig/sg\_action\_groups.yml
> 
> > SUCC: Configuration for ‘actiongroups’ created or updated
> 
> > Done with success
> 
> > ``
> 
> > get searchguard/\_search
> > 
> > {
> 
> > “took”: 1,
> 
> > “timed\_out”: false,
> 
> > “\_shards”: {
> 
> > “total”: 1,
> 
> > “successful”: 1,
> 
> > “skipped”: 0,
> 
> > “failed”: 0
> 
> > },
> 
> > “hits”: {
> 
> > “total”: 0,
> 
> > “max\_score”: null,
> 
> > “hits”:
> 
> > }
> 
> > }
> 
> > ``
> 
> >

---

<div class="post-metadata">

**Author:** ![mu\_piko](https://avatars.discourse-cdn.com/v4/letter/m/b3f665/32.png) [@mu\_piko](https://forum.search-guard.com/u/mu_piko)\
**Post date:** [February 2, 2018, 4:57am UTC](https://forum.search-guard.com/t/can-not-use-the-search-guard-configuration-gui-for-privilege-management-of-kibana/772/3 "2018-02-02T04:57:19Z")

</div>

I understand that the GUI can be used only in the enterprise.

Thank you for answering.

2018年2月2日金曜日 7時15分54秒 UTC+9 Jochen Kressin:

> **···**
>
> > Yes, the searchguard index contains sensitive information, so you can view and edit it’s contents only if you provide an admin certificate with your request.
> 
> > As to your issue, you are running the community edition of Search Guard:
> 
> > 
> 
> > searchguard.enterprise\_modules\_enabled: false
> 
> > 
> 
> > The Config GUI is an enterprise features because it relies on the REST API. We should make that clearer in the docs though.
> > 
> > On Thursday, February 1, 2018 at 12:50:59 PM UTC+1, mu piko wrote:
> > 
> > > When asking questions, please provide the following information:
> 
> > > - Search Guard and Elasticsearch version
> 
> > > 6.0.0
> 
> > >
> 
> > > - Installed and used enterprise modules, if any
> 
> > > not enterprise
> 
> > >
> 
> > > - JVM version and operating system version
> 
> > > CentOS Linux release 7.4.1708 (Core)
> 
> > > openjdk version “1.8.0\_151”
> 
> > >
> 
> > > - Search Guard configuration files
> 
> > > - Elasticsearch log messages on debug level
> 
> > > - Other installed Elasticsearch or Kibana plugins, if any
> 
> > > pluigins:
> 
> > > analysis-icu
> 
> > > search-guard-6
> 
> > > and
> 
> > > Kibana
> 
> > >
> 
> > >
> 
> > > ## problem
> 
> > >
> 
> > > I set it according to the following URL, but the Search Guard menu does not appear.
> 
> > > [LINK](http://docs.search-guard.com/latest/configuration-gui)
> 
> > >
> 
> > > ## State
> 
> > >
> 
> > > All indexes on all nodes, replica is in green state.
> 
> > > Both Elasticsearch and Kibana can operate with SSL connection.
> 
> > > All the settings are attached.
> 
> > >
> 
> > > ## Doubt
> 
> > >
> 
> > > Is it correct that `searchguard` index is empty even if you run` sgadmin.sh`?
> 
> > >
> 
> > > # /usr/share/elasticsearch/plugins/search-guard-6/tools/sgadmin.sh -cd /usr/share/elasticsearch/plugins/search-guard-6/sgconfig -icl -nhnv -cacert /etc/elasticsearch/chain-ca.pem -cert /etc/elasticsearch/sgadmin.crtfull.pem -key /etc/elasticsearch/sgadmin.key.pem
> 
> > > Search Guard Admin v6
> 
> > > Will connect to localhost:9300 … done
> 
> > > Connected as CN=sgadmin,OU=System Solution,O=Misou System,L=Sumida,ST=Tokyo,C=JP
> 
> > > Contacting elasticsearch cluster ‘elasticsearch’ and wait for YELLOW clusterstate …
> 
> > > Clustername: mimail-cluster
> 
> > > Clusterstate: GREEN
> 
> > > Number of nodes: 3
> 
> > > Number of data nodes: 3
> 
> > > searchguard index does not exists, attempt to create it … done (auto expand replicas is on)
> 
> > > Populate config from /usr/share/elasticsearch/plugins/search-guard-6/sgconfig/
> 
> > > Will update ‘config’ with /usr/share/elasticsearch/plugins/search-guard-6/sgconfig/sg\_config.yml
> 
> > > SUCC: Configuration for ‘config’ created or updated
> 
> > > Will update ‘roles’ with /usr/share/elasticsearch/plugins/search-guard-6/sgconfig/sg\_roles.yml
> 
> > > SUCC: Configuration for ‘roles’ created or updated
> 
> > > Will update ‘rolesmapping’ with /usr/share/elasticsearch/plugins/search-guard-6/sgconfig/sg\_roles\_mapping.yml
> 
> > > SUCC: Configuration for ‘rolesmapping’ created or updated
> 
> > > Will update ‘internalusers’ with /usr/share/elasticsearch/plugins/search-guard-6/sgconfig/sg\_internal\_users.yml
> 
> > > SUCC: Configuration for ‘internalusers’ created or updated
> 
> > > Will update ‘actiongroups’ with /usr/share/elasticsearch/plugins/search-guard-6/sgconfig/sg\_action\_groups.yml
> 
> > > SUCC: Configuration for ‘actiongroups’ created or updated
> 
> > > Done with success
> 
> > > ``
> 
> > > get searchguard/\_search
> > > 
> > > {
> 
> > > “took”: 1,
> 
> > > “timed\_out”: false,
> 
> > > “\_shards”: {
> 
> > > “total”: 1,
> 
> > > “successful”: 1,
> 
> > > “skipped”: 0,
> 
> > > “failed”: 0
> 
> > > },
> 
> > > “hits”: {
> 
> > > “total”: 0,
> 
> > > “max\_score”: null,
> 
> > > “hits”:
> 
> > > }
> 
> > > }
> 
> > > ``
> 
> > >