# installed search guard but can not login to elasticSearch(also for kibina) with created user account **URL:** \ **Category:** Search Guard\ **Created:** [November 27, 2018, 9:36am UTC](https://forum.search-guard.com/t/installed-search-guard-but-can-not-login-to-elasticsearch-also-for-kibina-with-created-user-account/1214 "2018-11-27T09:36:43Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Jin\_Park](https://avatars.discourse-cdn.com/v4/letter/j/5f9b8f/32.png) [@Jin\_Park](https://forum.search-guard.com/u/Jin_Park)\ **Post date:** [November 27, 2018, 9:36am UTC](https://forum.search-guard.com/t/installed-search-guard-but-can-not-login-to-elasticsearch-also-for-kibina-with-created-user-account/1214/1 "2018-11-27T09:36:43Z")
- Search Guard and Elasticsearch version Elastic Search, Kibana : 6.4.2 Search Guard: equivalent version for Elastic and Kibana - JVM version and operating system version Java version 10.0.2 with MacOS > **···** > > ====== > > my personal goal is creating new account for practice, but I coludn’t login to kibana with created account. > > given default accounts (e.g admin, readall and logstash) work well with my setting. > > I tried uncountables times for log-in but it says “acccount or password is wrong” > > please I need your help > > the following steps are what I did for my personal setup. > > 1. Installed search-guard to elastic-search and kibana > > 2. extracted demo certificates to elastic-search config folder. > > 3. added extra lines to elasticsearch.yml as follows > > ```auto > > # ------------------ X-pack (Jin's Code) ------------------------ > > xpack.security.enabled: false > > xpack.monitoring.enabled: false > > xpack.graph.enabled: false > > xpack.watcher.enabled: false > > # -------------- Search Guard (Jin's Code) --------------- > > searchguard.ssl.transport.pemcert_filepath: esnode.pem > > searchguard.ssl.transport.pemkey_filepath: esnode-key.pem > > searchguard.ssl.transport.pemtrustedcas_filepath: root-ca.pem > > searchguard.ssl.transport.enforce_hostname_verification: false > > searchguard.ssl.http.enabled: true > > searchguard.ssl.http.pemcert_filepath: esnode.pem > > searchguard.ssl.http.pemkey_filepath: esnode-key.pem > > searchguard.ssl.http.pemtrustedcas_filepath: root-ca.pem > > searchguard.allow_unsafe_democertificates: true > > searchguard.allow_default_init_sgindex: true > > searchguard.authcz.admin_dn: > > - CN=kirk,OU=client,O=client,L=test,C=de > > ``` > > 1. added extra lines to kibana.yml(for Kibana) as follows > > ```auto > > #===================Search Guard (Jin's Code)=================== > > xpack.security.enabled: false > > searchguard.auth.type: "basicauth" > > elasticsearch.url: "https://localhost:9200" > > elasticsearch.ssl.verificationMode: none > > elasticsearch.username: "admin" > > elasticsearch.password: "admin" > > ``` > > 1. created an account in sg\_internal\_users.yml (…/plugins/search-guard-6/sgconfig/) as follows > > ```auto > > jin: > > hash: $2y$12$T0EYKXLrUNhAFzjacQmIj.SOQw6Jl5kH2yvVwtbZFmynrKBDpF/vO > > roles: > > - readall > > ``` > > 1. added extra line to sg\_roles\_mapping.yml as follows > > sg\_readall: > > readonly: true > > backendroles: > > ``` > - readall > > - jin #new account > > ``` > > 1. restarted elastic-search and kibana ---
**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\ **Post date:** [November 27, 2018, 4:20pm UTC](https://forum.search-guard.com/t/installed-search-guard-but-can-not-login-to-elasticsearch-also-for-kibina-with-created-user-account/1214/2 "2018-11-27T16:20:28Z")
The Search Guard configuration is stored in an Elasticsearch index, so all nodes in the cluster have the same security settings (roles, users, permissions etc.) In order to apply configuration changes it is not sufficient to just change the files. You have to apply the changes by using sgadmin. Please refer to the “Applying configuration changes” chapter in the docs: [https://docs.search-guard.com/latest/sgadmin](https://docs.search-guard.com/latest/sgadmin) If you use the demo installer, you will find a sgadmin\_demo.sh script in the tools folder which contains a pre-configured sgadmin call. > **···** > > On Tuesday, November 27, 2018 at 10:36:44 AM UTC+1, Jin Park wrote: > > > > > > - Search Guard and Elasticsearch version > > > Elastic Search, Kibana : 6.4.2 > > > Search Guard: equivalent version for Elastic and Kibana > > > > > > - JVM version and operating system version > > > Java version 10.0.2 with MacOS > > > > > > ====== > > > > > > my personal goal is creating new account for practice, but I coludn’t login to kibana with created account. > > > given default accounts (e.g admin, readall and logstash) work well with my setting. > > > I tried uncountables times for log-in but it says “acccount or password is wrong” > > > please I need your help > > > > > > the following steps are what I did for my personal setup. > > > > > > 1. Installed search-guard to elastic-search and kibana > > > 1. extracted demo certificates to elastic-search config folder. > > > 1. added extra lines to elasticsearch.yml as follows > > > > > > ```auto > > > > ``` > > > # ------------------ X-pack (Jin’s Code) ------------------------ > > > xpack.security.enabled: false > > > xpack.monitoring.enabled: false > > > xpack.graph.enabled: false > > > xpack.watcher.enabled: false > > > # -------------- Search Guard (Jin’s Code) --------------- > > > searchguard.ssl.transport.pemcert\_filepath: esnode.pem > > > searchguard.ssl.transport.pemkey\_filepath: esnode-key.pem > > > searchguard.ssl.transport.pemtrustedcas\_filepath: root-ca.pem > > > searchguard.ssl.transport.enforce\_hostname\_verification: false > > > searchguard.ssl.http.enabled: true > > > searchguard.ssl.http.pemcert\_filepath: esnode.pem > > > searchguard.ssl.http.pemkey\_filepath: esnode-key.pem > > > searchguard.ssl.http.pemtrustedcas\_filepath: root-ca.pem > > > searchguard.allow\_unsafe\_democertificates: true > > > searchguard.allow\_default\_init\_sgindex: true > > > searchguard.authcz.admin\_dn: > > > - CN=kirk,OU=client,O=client,L=test,C=de > > > ```auto > > > > ``` > > > > > > 1. added extra lines to kibana.yml(for Kibana) as follows > > > > > > ```auto > > > > ``` > > > #===================Search Guard (Jin’s Code)=================== > > > xpack.security.enabled: false > > > searchguard.auth.type: “basicauth” > > > elasticsearch.url: “[https://localhost:9200](https://localhost:9200)” > > > elasticsearch.ssl.verificationMode: none > > > elasticsearch.username: “admin” > > > elasticsearch.password: “admin” > > > ```auto > > > > ``` > > > > > > 1. created an account in sg\_internal\_users.yml (…/plugins/search-guard-6/sgconfig/) as follows > > > > > > ```auto > > > > ``` > > > jin: > > > hash: $2y$12$T0EYKXLrUNhAFzjacQmIj.SOQw6Jl5kH2yvVwtbZFmynrKBDpF/vO > > > roles: > > > ``` > > - readall > > > > ``` > > > ```auto > > > > ``` > > > > > > 1. added extra line to sg\_roles\_mapping.yml as follows > > > > > > sg\_readall: > > > readonly: true > > > backendroles: > > > ``` > > - readall > > > > ``` > > > ``` > > - jin #new account > > > > ``` > > > > > > 1. restarted elastic-search and kibana > > > > > > > > > ---
**Author:** ![Jin\_Park](https://avatars.discourse-cdn.com/v4/letter/j/5f9b8f/32.png) [@Jin\_Park](https://forum.search-guard.com/u/Jin_Park)\ **Post date:** [November 28, 2018, 3:59am UTC](https://forum.search-guard.com/t/installed-search-guard-but-can-not-login-to-elasticsearch-also-for-kibina-with-created-user-account/1214/3 "2018-11-28T03:59:41Z")
Thank you for your useful reply Mr.Kressin. I just got closer to the solution what I’m looking for. But it seems like I got another problem. I couldn’t find anything about sgadmin\_demo.sh so I executed sgadmin.sh instead need another help My Command : > **···** > > ```auto > > bash sgadmin.sh -p 9200 -cd ../sgconfig/ -icl -nhnv --diagnose -cacert ../../../config/root-ca.pem -cert ../../../config/kirk.pem -key ../../../config/kirk-key.pem > > ``` > > I got this : > > ```auto > > WARNING: JAVA_HOME not set, will use /usr/bin/java > > Search Guard Admin v6 > > WARNING: Seems you want connect to the Elasticsearch HTTP port. > > sgadmin connects on the transport port which is normally 9300. > > Will connect to localhost:9200 ... done > > Unable to check whether cluster is sane: None of the configured nodes are available: [{#transport#-1}{07V7_n7uQoGY6v8Zkt99EQ}{localhost}{[127.0.0.1:9200](http://127.0.0.1:9200)}] > > ERR: Cannot connect to Elasticsearch. Please refer to elasticsearch logfile for more information > > Trace: > > ``` > > > > ---
**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\ **Post date:** [November 28, 2018, 10:34am UTC](https://forum.search-guard.com/t/installed-search-guard-but-can-not-login-to-elasticsearch-also-for-kibina-with-created-user-account/1214/4 "2018-11-28T10:34:45Z")
You need to execute sgadmin on the transport port (default: 9300), not on the HTTP port (default: 9200) > **···** > > On Wednesday, November 28, 2018 at 4:58:23 AM UTC+1, Jin Park wrote: > > > Thank you for your useful reply Mr.Kressin. I just got closer to the solution what I’m looking for. > > But it seems like I got another problem. I couldn’t find anything about sgadmin\_demo.sh so I executed sgadmin.sh instead > > > need another help > > > > > > My Command : > > > ```auto > > > > ``` > > > bash sgadmin.sh -p 9200 -cd …/sgconfig/ -icl -nhnv --diagnose -cacert …/…/…/config/root-ca.pem -cert …/…/…/config/kirk.pem -key …/…/…/config/kirk-key.pem > > > ```auto > > > > ``` > > > > > > I got this : > > > ```auto > > > > ``` > > > WARNING: JAVA\_HOME not set, will use /usr/bin/java > > > Search Guard Admin v6 > > > WARNING: Seems you want connect to the Elasticsearch HTTP port. > > > ``` > > sgadmin connects on the transport port which is normally 9300. > > > > ``` > > > Will connect to localhost:9200 … done > > > Unable to check whether cluster is sane: None of the configured nodes are available: [{#transport#-1}{07V7\_n7uQoGY6v8Zkt99EQ}{localhost}{[127.0.0.1:9200](http://127.0.0.1:9200)}] > > > ERR: Cannot connect to Elasticsearch. Please refer to elasticsearch logfile for more information > > > Trace: > > > ```auto > > > > ``` > > > > > ---
**Author:** ![Jin\_Park](https://avatars.discourse-cdn.com/v4/letter/j/5f9b8f/32.png) [@Jin\_Park](https://forum.search-guard.com/u/Jin_Park)\ **Post date:** [November 29, 2018, 3:30am UTC](https://forum.search-guard.com/t/installed-search-guard-but-can-not-login-to-elasticsearch-also-for-kibina-with-created-user-account/1214/5 "2018-11-29T03:30:44Z")
wonderful, now it’s working Thank you