# HTTP Method Error with Search Guard sgctl.sh Commands **URL:** \ **Category:** Search Guard\ **Created:** [January 10, 2024, 12:45pm UTC](https://forum.search-guard.com/t/http-method-error-with-search-guard-sgctl-sh-commands/2481 "2024-01-10T12:45:17Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![dafq](https://avatars.discourse-cdn.com/v4/letter/d/9de0a6/32.png) [@dafq](https://forum.search-guard.com/u/dafq)\ **Post date:** [January 10, 2024, 12:45pm UTC](https://forum.search-guard.com/t/http-method-error-with-search-guard-sgctl-sh-commands/2481/1 "2024-01-10T12:45:17Z")
**Elasticsearch version:** Elasticsearch version 7.10.0 and Search Guard version 49.3.0. **Server OS version:** macOS sonoma 14.1.2 **Describe the issue:** I followed the instructions in the [Search Guard installation manual](https://docs.search-guard.com/latest/manual-installation) for installation, and the `./sgctl.sh connect` command works successfully. However, when I run `./sgctl.sh update-config path/to/config/dir/`, I encounter the following error: Successfully connected to cluster null (localhost) as user CN=kirk,OU=client,O=client,L=test,C=de Incorrect HTTP method for uri [/\_searchguard/config] and method [PUT], allowed: [POST] I would greatly appreciate any assistance in finding the cause or solution to this issue. Please help me identify any misconfigurations or missing steps. **Provide configuration:** elasticsearch/config/elasticsearch.yml ```auto searchguard.ssl.transport.pemcert_filepath: esnode.pem searchguard.ssl.transport.pemkey_filepath: esnode-key.pem searchguard.ssl.transport.pemtrustedcas_filepath: root-ca.pem searchguard.ssl.transport.enforce_hostname_verification: false searchguard.ssl.http.enabled: true searchguard.ssl.http.pemcert_filepath: esnode.pem searchguard.ssl.http.pemkey_filepath: esnode-key.pem searchguard.ssl.http.pemtrustedcas_filepath: root-ca.pem searchguard.allow_unsafe_democertificates: true searchguard.allow_default_init_sgindex: true searchguard.authcz.admin_dn: - CN=kirk,OU=client,O=client,L=test,C=de searchguard.enable_snapshot_restore_privilege: true searchguard.check_snapshot_restore_write_privileges: true searchguard.restapi.roles_enabled: ["SGS_ALL_ACCESS"] xpack.security.enabled: false ``` elasticsearch/plugins/search-guard-7/sgconfig/sg\_config.yml ```auto _sg_meta: type: "config" config_version: 2 ``` ```auto sg_config: dynamic: # Set filtered_alias_mode to 'disallow' to forbid more than 2 filtered aliases per index # Set filtered_alias_mode to 'warn' to allow more than 2 filtered aliases per index but warns about it (default) # Set filtered_alias_mode to 'nowarn' to allow more than 2 filtered aliases per index silently #filtered_alias_mode: warn #do_not_fail_on_forbidden: false #kibana: # Kibana multitenancy - NOT FREE FOR COMMERCIAL USE # In addition to the config options below you need to set do_not_fail_on_forbidden to true (see above). # Kibana needs to be configured for multi tenancy as well. # See https://docs.search-guard.com/latest/kibana-multi-tenancy for details #multitenancy_enabled: true #server_username: kibanaserver #index: '.kibana' http: anonymous_auth_enabled: false xff: enabled: false internalProxies: '192\.168\.0\.10|192\.168\.0\.11' # regex pattern #internalProxies: '.*' # trust all internal proxies, regex pattern #remoteIpHeader: 'x-forwarded-for' ###### see https://docs.oracle.com/javase/7/docs/api/java/util/regex/Pattern.html for regex help ###### more information about XFF https://en.wikipedia.org/wiki/X-Forwarded-For ###### and here https://tools.ietf.org/html/rfc7239 ###### and https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Remote_IP_Valve auth_token_provider: # NOT FREE FOR COMMERCIAL USE # To enable using Search Guard auth tokens, you also need to enable the sg_issued_jwt_auth_domain below. enabled: false # JWTs produced by Search Guard are signed by default with a symmetric HMAC512 hash. For production systems, # you must replace the value specified here by your own key. You can generate a new key for example with: # openssl rand -base64 512 | tr '/+' '_-' # If you want ot use another signature algorithm, you can specify a complete JWK using the attriubute jwt_signing_key. # Refer to the documentation for details. jwt_signing_key_hs512: "eTDZjSqRD9Abhod9iqeGX_7o93a-eElTeXWAF6FmzQshmRIrPD-C9ET3pFjJ_IBrzmWIZDk8ig-X_PIyGmKsxNMsrU-0BNWF5gJq5xOp4rYTl8z66Tw9wr8tHLxLxgJqkLSuUCRBZvlZlQ7jNdhBBxgM-hdSSzsN1T33qdIwhrUeJ-KXI5yKUXHjoWFYb9tETbYQ4NvONowkCsXK_flp-E3F_OcKe_z5iVUszAV8QfCod1zhbya540kDejXCL6N_XMmhWJqum7UJ3hgf6DEtroPSnVpHt4iR5w9ArKK-IBgluPght03gNcoNqwz7p77TFbdOmUKF_PWy1bcdbaUoSg" # JWTs produced by Search Guard are unencrypted by default. Set a key here to activate encryption using AES Key Wrap. # If you want ot use another signature algorithm, you can specify a complete JWK using the attriubute jwt_encryption_key. # Refer to the documentation for details. #jwt_encryption_key_a256kw: "..." # Specify the maximum time period an auth token may be valid. Omit max_validity to have keys with unlimited lifetime. # Note that when creating auth tokens, users can specify an even shorter time period. max_validity: "1y" # This specifies the maximum number of valid tokens a user can have at the same time. max_tokens_per_user: 100 authc: kerberos_auth_domain: http_enabled: false transport_enabled: false order: 6 http_authenticator: type: kerberos # NOT FREE FOR COMMERCIAL USE challenge: true config: # If true a lot of kerberos/security related debugging output will be logged to standard out krb_debug: false # If true then the realm will be stripped from the user name strip_realm_from_principal: true authentication_backend: type: noop basic_internal_auth_domain: description: "Authenticate via HTTP Basic against internal users database" http_enabled: true transport_enabled: true order: 4 http_authenticator: type: basic challenge: true authentication_backend: type: intern proxy_auth_domain: description: "Authenticate via proxy" http_enabled: false transport_enabled: false order: 3 http_authenticator: type: proxy challenge: false config: user_header: "x-proxy-user" roles_header: "x-proxy-roles" authentication_backend: type: noop jwt_auth_domain: description: "Authenticate via Json Web Token" http_enabled: false transport_enabled: false order: 0 http_authenticator: type: jwt challenge: false config: signing_key: "base64 encoded HMAC key or public RSA/ECDSA pem key" jwt_header: "Authorization" jwt_url_parameter: null roles_key: null subject_key: null authentication_backend: type: noop sg_issued_jwt_auth_domain: description: "Authenticate via Json Web Tokens issued by Search Guard" http_enabled: false # This auth domain is only available for HTTP order: 1 http_authenticator: type: sg_auth_token challenge: false # This auth domain automatically pulls configuration from the auth_token_provider config above authentication_backend: type: sg_auth_token clientcert_auth_domain: description: "Authenticate via SSL client certificates" http_enabled: false transport_enabled: false order: 2 http_authenticator: type: clientcert config: username_attribute: cn #optional, if omitted DN becomes username challenge: false authentication_backend: type: noop ldap: description: "Authenticate via LDAP or Active Directory" http_enabled: false transport_enabled: false order: 5 http_authenticator: type: basic challenge: false authentication_backend: # LDAP authentication backend (authenticate users against a LDAP or Active Directory) type: ldap # NOT FREE FOR COMMERCIAL USE config: # enable ldaps enable_ssl: false # enable start tls, enable_ssl should be false enable_start_tls: false # send client certificate enable_ssl_client_auth: false # verify ldap hostname verify_hostnames: true hosts: - localhost:8389 bind_dn: null password: null userbase: 'ou=people,dc=example,dc=com' # Filter to search for users (currently in the whole subtree beneath userbase) # {0} is substituted with the username usersearch: '(sAMAccountName={0})' # Use this attribute from the user as username (if not set then DN is used) username_attribute: null authz: roles_from_myldap: description: "Authorize via LDAP or Active Directory" http_enabled: false transport_enabled: false authorization_backend: # LDAP authorization backend (gather roles from a LDAP or Active Directory, you have to configure the above LDAP authentication backend settings too) type: ldap # NOT FREE FOR COMMERCIAL USE config: # enable ldaps enable_ssl: false # enable start tls, enable_ssl should be false enable_start_tls: false # send client certificate enable_ssl_client_auth: false # verify ldap hostname verify_hostnames: true hosts: - localhost:8389 bind_dn: null password: null rolebase: 'ou=groups,dc=example,dc=com' # Filter to search for roles (currently in the whole subtree beneath rolebase) # {0} is substituted with the DN of the user # {1} is substituted with the username # {2} is substituted with an attribute value from user's directory entry, of the authenticated user. Use userroleattribute to specify the name of the attribute rolesearch: '(member={0})' # Specify the name of the attribute which value should be substituted with {2} above userroleattribute: null # Roles as an attribute of the user entry userrolename: disabled #userrolename: memberOf # The attribute in a role entry containing the name of that role, Default is "name". # Can also be "dn" to use the full DN as rolename. rolename: cn # Resolve nested roles transitive (roles which are members of other roles and so on ...) resolve_nested_roles: true userbase: 'ou=people,dc=example,dc=com' # Filter to search for users (currently in the whole subtree beneath userbase) # {0} is substituted with the username usersearch: '(uid={0})' # Skip users matching a user name, a wildcard or a regex pattern #skip_users: # - 'cn=Michael Jackson,ou*people,o=TEST' # - '/\S*/' roles_from_another_ldap: description: "Authorize via another Active Directory" http_enabled: false transport_enabled: false authorization_backend: type: ldap # NOT FREE FOR COMMERCIAL USE ``` ---
**Author:** ![mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@mantas](https://forum.search-guard.com/u/mantas)\ **Post date:** [January 10, 2024, 1:48pm UTC](https://forum.search-guard.com/t/http-method-error-with-search-guard-sgctl-sh-commands/2481/2 "2024-01-10T13:48:35Z")
Hi @dafq, I have noticed that you are using Search Guard Classic, the `sgctl.sh` is for Search Guard FLX. > [@dafq](#): > > Search Guard version 49.3.0. Please refer to the documentation below for the compatible tool with your Search Guard version (`sgadmin`): > **[TLS Demo Certificates](https://docs.search-guard.com/7.x-49/tls-demo-certificates#using-sgadmin-with-the-demo-certificates)** > > Download the Search Guard TLS demo certificates for setting up a working PoC in no time. Works on Linux, Mac and Windows. Thanks, mj ---
**Author:** ![dafq](https://avatars.discourse-cdn.com/v4/letter/d/9de0a6/32.png) [@dafq](https://forum.search-guard.com/u/dafq)\ **Post date:** [January 10, 2024, 10:59pm UTC](https://forum.search-guard.com/t/http-method-error-with-search-guard-sgctl-sh-commands/2481/3 "2024-01-10T22:59:57Z")
Thank you so much for your help ---
**Author:** ![system](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/system/32/1870_2.png) [@system](https://forum.search-guard.com/u/system)\ **Post date:** [January 31, 2024, 11:00pm UTC](https://forum.search-guard.com/t/http-method-error-with-search-guard-sgctl-sh-commands/2481/4 "2024-01-31T23:00:46Z")
This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.