# Errors from the client node **URL:** \ **Category:** Search Guard\ **Created:** [June 15, 2016, 5:22am UTC](https://forum.search-guard.com/t/errors-from-the-client-node/194 "2016-06-15T05:22:58Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Wei\_Hong](https://avatars.discourse-cdn.com/v4/letter/w/da6949/32.png) [@Wei\_Hong](https://forum.search-guard.com/u/Wei_Hong)\ **Post date:** [June 15, 2016, 5:22am UTC](https://forum.search-guard.com/t/errors-from-the-client-node/194/1 "2016-06-15T05:22:58Z")
Here is my version: elasticsearch2.2.0 search-guard-2-2.2.0.0-alpha2 search-guard-ssl-2.2.0.6 Before the installed sg2, the elasticsearch is green. I have installed the sg2 in the 3 data nodes. 1 data node is used as the client node. the client node’s elasticsearch yml is: searchguard.authcz.admin\_dn: “CN=kirk,OU=client,O=client,l=tEst, C=De” #SSL searchguard.ssl.transport.enabled: true searchguard.ssl.transport.keystore\_filepath: kirk-keystore.jks searchguard.ssl.transport.truststore\_filepath: truststore.jks searchguard.ssl.transport.enforce\_hostname\_verification: false searchguard.ssl.http.enabled: true searchguard.ssl.http.keystore\_filepath: kirk-keystore.jks searchguard.ssl.http.truststore\_filepath: truststore.jks searchguard.ssl.http.enable\_openssl\_if\_available: true searchguard.ssl.transport.enable\_openssl\_if\_available: true security.manager.enabled: false the other two nodes elasticsearch yml is: #SSL searchguard.ssl.transport.enabled: true searchguard.ssl.transport.keystore\_filepath: node-1-keystore.jks searchguard.ssl.transport.truststore\_filepath: truststore.jks searchguard.ssl.transport.enforce\_hostname\_verification: false searchguard.ssl.http.enabled: true searchguard.ssl.http.keystore\_filepath: node-1-keystore.jks searchguard.ssl.http.truststore\_filepath: truststore.jks searchguard.ssl.http.enable\_openssl\_if\_available: true searchguard.ssl.transport.enable\_openssl\_if\_available: true security.manager.enabled: false When i finished the configuration, I run the elasticsearch. There are some errors in the client node: [internal:discovery/zen/unicast]]; nested: ElasticsearchSecurityException[Internal or shard requests not allowed from a client node]; Caused by: ElasticsearchSecurityException[Internal or shard requests not allowed from a client node] at com.floragunn.searchguard.transport.SearchGuardTransportService.messageReceivedDecorate(SearchGuardTransportService.java:183) at com.floragunn.searchguard.ssl.transport.SearchGuardSSLTransportService$Interceptor.messageReceived(SearchGuardSSLTransportService.java:107) at org.elasticsearch.transport.netty.MessageChannelHandler.handleRequest(MessageChannelHandler.java:244) at com.floragunn.searchguard.ssl.transport.SearchGuardMessageChannelHandler.handleRequest(SearchGuardMessageChannelHandler.java:57) at org.elasticsearch.transport.netty.MessageChannelHandler.messageReceived(MessageChannelHandler.java:114) at com.floragunn.searchguard.ssl.transport.SearchGuardMessageChannelHandler.messageReceived(SearchGuardMessageChannelHandler.java:45) at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70) at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564) at org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791) at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:296) at org.jboss.netty.handler.codec.frame.FrameDecoder.unfoldAndFireMessageReceived(FrameDecoder.java:462) at org.jboss.netty.handler.codec.frame.FrameDecoder.callDecode(FrameDecoder.java:443) at org.jboss.netty.handler.codec.frame.FrameDecoder.messageReceived(FrameDecoder.java:303) at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70) at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564) at org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791) at org.elasticsearch.common.netty.OpenChannelsHandler.handleUpstream(OpenChannelsHandler.java:75) at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564) at org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791) at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:296) at org.jboss.netty.handler.codec.frame.FrameDecoder.unfoldAndFireMessageReceived(FrameDecoder.java:462) at org.jboss.netty.handler.codec.frame.FrameDecoder.callDecode(FrameDecoder.java:443) at org.jboss.netty.handler.codec.frame.FrameDecoder.messageReceived(FrameDecoder.java:303) at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70) at Here, i have some questions: 1. In my cluster, i have 3 data nodes which can elect as the master node. I regard one data node as the client node. Is the try right? 2. Is the entry "searchguard.authcz.admin\_dn:“CN=kirk,OU=client,O=client,l=tEst, C=De” " only put in the client node’ elasticsearch.yml? There is no need in the other data nodes? 3.What is the error mean above？ Thanks very much！ ---
**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\ **Post date:** [June 15, 2016, 7:59am UTC](https://forum.search-guard.com/t/errors-from-the-client-node/194/2 "2016-06-15T07:59:27Z")
Please upgrade to ES 2.3.3 with SG 2.3.3.0-rc1 and SG SSL 2.3.3.11 > 1. In my cluster, i have 3 data nodes which can elect as the master node. I regard one data node as the client node. Is the try right? No, a #sgsn can never be a #sgnsnc (you have to use server certificates with the OID for all your nodes!) See [GitHub - floragunncom/search-guard: Search Guard Plugin - Security for Elasticsearch](https://github.com/floragunncom/search-guard/wiki/Terminology) for terminology > 2. Is the entry "searchguard.authcz.admin\_dn:"CN=kirk,OU=client,O=client,l=tEst, C=De" " only put in the client node' elasticsearch.yml? There is no need in the other data nodes? elasticsearch.yml needs to be identical for all nodes > 3.What is the error mean above？ That you try to join the cluster with a client certificate (without OID) instead of a server certificate Meanwhile we have a good documentation for all this, pls. refer to [https://github.com/floragunncom/search-guard-ssl-docs](https://github.com/floragunncom/search-guard-ssl-docs) You can also inspect the vagrant demos to see how it works: - [https://github.com/floragunncom/search-guard-ssl/blob/master/Vagrantfile](https://github.com/floragunncom/search-guard-ssl/blob/master/Vagrantfile) - [https://github.com/floragunncom/search-guard/blob/master/Vagrantfile](https://github.com/floragunncom/search-guard/blob/master/Vagrantfile) > **···** > > > Am 15.06.2016 um 07:22 schrieb Wei Hong \: > > > > Here is my version: > > elasticsearch2.2.0 > > search-guard-2-2.2.0.0-alpha2 > > search-guard-ssl-2.2.0.6 > > > > Before the installed sg2, the elasticsearch is green. > > I have installed the sg2 in the 3 data nodes. 1 data node is used as the client node. > > > > the client node's elasticsearch yml is: > > > > searchguard.authcz.admin\_dn: > > > > "CN=kirk,OU=client,O=client,l=tEst, C=De" > > #SSL > > searchguard.ssl.transport.enabled: true > > searchguard.ssl.transport.keystore\_filepath: kirk-keystore.jks > > searchguard.ssl.transport.truststore\_filepath: truststore.jks > > searchguard.ssl.transport.enforce\_hostname\_verification: false > > searchguard.ssl.http.enabled: true > > searchguard.ssl.http.keystore\_filepath: kirk-keystore.jks > > searchguard.ssl.http.truststore\_filepath: truststore.jks > > searchguard.ssl.http.enable\_openssl\_if\_available: true > > searchguard.ssl.transport.enable\_openssl\_if\_available: true > > security.manager.enabled: false > > > > the other two nodes elasticsearch yml is: > > > > #SSL > > searchguard.ssl.transport.enabled: true > > searchguard.ssl.transport.keystore\_filepath: node-1-keystore.jks > > searchguard.ssl.transport.truststore\_filepath: truststore.jks > > searchguard.ssl.transport.enforce\_hostname\_verification: false > > searchguard.ssl.http.enabled: true > > searchguard.ssl.http.keystore\_filepath: node-1-keystore.jks > > searchguard.ssl.http.truststore\_filepath: truststore.jks > > searchguard.ssl.http.enable\_openssl\_if\_available: true > > searchguard.ssl.transport.enable\_openssl\_if\_available: true > > security.manager.enabled: false > > > > When i finished the configuration, I run the elasticsearch. There are some errors in the client node: > > [internal:discovery/zen/unicast]]; nested: ElasticsearchSecurityException[Internal or shard requests not allowed from a client node]; > > Caused by: ElasticsearchSecurityException[Internal or shard requests not allowed from a client node] > > at com.floragunn.searchguard.transport.SearchGuardTransportService.messageReceivedDecorate(SearchGuardTransportService.java:183) > > at com.floragunn.searchguard.ssl.transport.SearchGuardSSLTransportService$Interceptor.messageReceived(SearchGuardSSLTransportService.java:107) > > at org.elasticsearch.transport.netty.MessageChannelHandler.handleRequest(MessageChannelHandler.java:244) > > at com.floragunn.searchguard.ssl.transport.SearchGuardMessageChannelHandler.handleRequest(SearchGuardMessageChannelHandler.java:57) > > at org.elasticsearch.transport.netty.MessageChannelHandler.messageReceived(MessageChannelHandler.java:114) > > at com.floragunn.searchguard.ssl.transport.SearchGuardMessageChannelHandler.messageReceived(SearchGuardMessageChannelHandler.java:45) > > at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70) > > at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564) > > at org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791) > > at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:296) > > at org.jboss.netty.handler.codec.frame.FrameDecoder.unfoldAndFireMessageReceived(FrameDecoder.java:462) > > at org.jboss.netty.handler.codec.frame.FrameDecoder.callDecode(FrameDecoder.java:443) > > at org.jboss.netty.handler.codec.frame.FrameDecoder.messageReceived(FrameDecoder.java:303) > > at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70) > > at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564) > > at org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791) > > at org.elasticsearch.common.netty.OpenChannelsHandler.handleUpstream(OpenChannelsHandler.java:75) > > at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564) > > at org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791) > > at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:296) > > at org.jboss.netty.handler.codec.frame.FrameDecoder.unfoldAndFireMessageReceived(FrameDecoder.java:462) > > at org.jboss.netty.handler.codec.frame.FrameDecoder.callDecode(FrameDecoder.java:443) > > at org.jboss.netty.handler.codec.frame.FrameDecoder.messageReceived(FrameDecoder.java:303) > > at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70) > > at > > > > Here, i have some questions: > > 1. In my cluster, i have 3 data nodes which can elect as the master node. I regard one data node as the client node. Is the try right? > > > > 2. Is the entry "searchguard.authcz.admin\_dn:"CN=kirk,OU=client,O=client,l=tEst, C=De" " only put in the client node' elasticsearch.yml? There is no need in the other data nodes? > > > > 3.What is the error mean above？ > > Thanks very much！ > > > > -- > > You received this message because you are subscribed to the Google Groups "Search Guard" group. > > To unsubscribe from this group and stop receiving emails from it, send an email to search-guard+unsubscribe@googlegroups.com. > > To post to this group, send email to search-guard@googlegroups.com. > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/326e237e-690d-4137-9a4a-ed8724223516%40googlegroups.com\](https://groups.google.com/d/msgid/search-guard/326e237e-690d-4137-9a4a-ed8724223516%40googlegroups.com%5C). > > For more options, visit [https://groups.google.com/d/optout\](https://groups.google.com/d/optout%5C). ---
**Author:** ![Wei\_Hong](https://avatars.discourse-cdn.com/v4/letter/w/da6949/32.png) [@Wei\_Hong](https://forum.search-guard.com/u/Wei_Hong)\ **Post date:** [June 15, 2016, 8:50am UTC](https://forum.search-guard.com/t/errors-from-the-client-node/194/3 "2016-06-15T08:50:47Z")
Really appreciate for your great help. 在 2016年6月15日星期三 UTC+8下午1:22:59，Wei Hong写道： > **···** > > > Here is my version: > > elasticsearch2.2.0 > > search-guard-2-2.2.0.0-alpha2 > > search-guard-ssl-2.2.0.6 > > > > Before the installed sg2, the elasticsearch is green. > > I have installed the sg2 in the 3 data nodes. 1 data node is used as the client node. > > > > the client node’s elasticsearch yml is: > > > > searchguard.authcz.admin\_dn: > > > > “CN=kirk,OU=client,O=client,l=tEst, C=De” > > #SSL > > searchguard.ssl.transport.enabled: true > > searchguard.ssl.transport.keystore\_filepath: kirk-keystore.jks > > searchguard.ssl.transport.truststore\_filepath: truststore.jks > > searchguard.ssl.transport.enforce\_hostname\_verification: false > > searchguard.ssl.http.enabled: true > > searchguard.ssl.http.keystore\_filepath: kirk-keystore.jks > > searchguard.ssl.http.truststore\_filepath: truststore.jks > > searchguard.ssl.http.enable\_openssl\_if\_available: true > > searchguard.ssl.transport.enable\_openssl\_if\_available: true > > security.manager.enabled: false > > > > the other two nodes elasticsearch yml is: > > > > #SSL > > searchguard.ssl.transport.enabled: true > > searchguard.ssl.transport.keystore\_filepath: node-1-keystore.jks > > searchguard.ssl.transport.truststore\_filepath: truststore.jks > > searchguard.ssl.transport.enforce\_hostname\_verification: false > > searchguard.ssl.http.enabled: true > > searchguard.ssl.http.keystore\_filepath: node-1-keystore.jks > > searchguard.ssl.http.truststore\_filepath: truststore.jks > > searchguard.ssl.http.enable\_openssl\_if\_available: true > > searchguard.ssl.transport.enable\_openssl\_if\_available: true > > security.manager.enabled: false > > > > When i finished the configuration, I run the elasticsearch. There are some errors in the client node: > > [internal:discovery/zen/unicast]]; nested: ElasticsearchSecurityException[Internal or shard requests not allowed from a client node]; > > Caused by: ElasticsearchSecurityException[Internal or shard requests not allowed from a client node] > > at com.floragunn.searchguard.transport.SearchGuardTransportService.messageReceivedDecorate(SearchGuardTransportService.java:183) > > at com.floragunn.searchguard.ssl.transport.SearchGuardSSLTransportService$Interceptor.messageReceived(SearchGuardSSLTransportService.java:107) > > at org.elasticsearch.transport.netty.MessageChannelHandler.handleRequest(MessageChannelHandler.java:244) > > at com.floragunn.searchguard.ssl.transport.SearchGuardMessageChannelHandler.handleRequest(SearchGuardMessageChannelHandler.java:57) > > at org.elasticsearch.transport.netty.MessageChannelHandler.messageReceived(MessageChannelHandler.java:114) > > at com.floragunn.searchguard.ssl.transport.SearchGuardMessageChannelHandler.messageReceived(SearchGuardMessageChannelHandler.java:45) > > at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70) > > at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564) > > at org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791) > > at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:296) > > at org.jboss.netty.handler.codec.frame.FrameDecoder.unfoldAndFireMessageReceived(FrameDecoder.java:462) > > at org.jboss.netty.handler.codec.frame.FrameDecoder.callDecode(FrameDecoder.java:443) > > at org.jboss.netty.handler.codec.frame.FrameDecoder.messageReceived(FrameDecoder.java:303) > > at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70) > > at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564) > > at org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791) > > at org.elasticsearch.common.netty.OpenChannelsHandler.handleUpstream(OpenChannelsHandler.java:75) > > at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564) > > at org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791) > > at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:296) > > at org.jboss.netty.handler.codec.frame.FrameDecoder.unfoldAndFireMessageReceived(FrameDecoder.java:462) > > at org.jboss.netty.handler.codec.frame.FrameDecoder.callDecode(FrameDecoder.java:443) > > at org.jboss.netty.handler.codec.frame.FrameDecoder.messageReceived(FrameDecoder.java:303) > > at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70) > > at > > > > Here, i have some questions: > > > 1. In my cluster, i have 3 data nodes which can elect as the master node. I regard one data node as the client node. Is the try right? > > > > > > 1. Is the entry "searchguard.authcz.admin\_dn:“CN=kirk,OU=client,O=client,l=tEst, C=De” " only put in the client node’ elasticsearch.yml? There is no need in the other data nodes? > > > > > > 3.What is the error mean above？ > > > Thanks very much！