# Running sgadmin - no permissions for indices:admin/exists **URL:** \ **Category:** Search Guard\ **Created:** [July 12, 2017, 2:14pm UTC](https://forum.search-guard.com/t/running-sgadmin-no-permissions-for-indices-admin-exists/519 "2017-07-12T14:14:25Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Michael](https://avatars.discourse-cdn.com/v4/letter/m/4bbf92/32.png) [@Michael](https://forum.search-guard.com/u/Michael)\ **Post date:** [July 12, 2017, 2:14pm UTC](https://forum.search-guard.com/t/running-sgadmin-no-permissions-for-indices-admin-exists/519/1 "2017-07-12T14:14:25Z")
OS: Red Hat Enterprise Linux Server release 7.3 JVM: openjdk version “1.8.0\_111” Search Guard: 5.5.0-14 Elasticsearch: 5.5.0-1 Number of nodes in cluster: 3 I upgraded from Search Guard 5.3.0 & Elasticsearch 5.3.0 and found I cannot update my Search Guard configuration using sgadmin.sh anymore. Whenever I run the the sgadmin.sh command, I get the following below error: > plugins/search-guard-5/tools/sgadmin.sh -h myhost -cd plugins/search-guard-5/sgconfig/ -ks mykeystore.jks -kspass kspass -ts mytruststore.jks -tspass tspass -nhnv -icl Contacting elasticsearch cluster ‘elasticsearch’ and wait for YELLOW clusterstate … Clustername: mycluster Clusterstate: GREEN Number of nodes: 3 Number of data nodes: 2 ERR: An unexpected ElasticsearchSecurityException occured: no permissions for indices:admin/exists Trace: ElasticsearchSecurityException[no permissions for indices:admin/exists] at com.floragunn.searchguard.filter.SearchGuardFilter.apply(SearchGuardFilter.java:147) at org.elasticsearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:168) at org.elasticsearch.action.support.TransportAction.execute(TransportAction.java:142) at org.elasticsearch.action.support.HandledTransportAction$TransportHandler.messageReceived(HandledTransportAction.java:64) at org.elasticsearch.action.support.HandledTransportAction$TransportHandler.messageReceived(HandledTransportAction.java:54) at com.floragunn.searchguard.ssl.transport.SearchGuardSSLRequestHandler.messageReceivedDecorate(SearchGuardSSLRequestHandler.java:177) at com.floragunn.searchguard.transport.SearchGuardRequestHandler.messageReceivedDecorate(SearchGuardRequestHandler.java:191) at com.floragunn.searchguard.ssl.transport.SearchGuardSSLRequestHandler.messageReceived(SearchGuardSSLRequestHandler.java:139) at com.floragunn.searchguard.SearchGuardPlugin$2$1.messageReceived(SearchGuardPlugin.java:336) at org.elasticsearch.transport.RequestHandlerRegistry.processMessageReceived(RequestHandlerRegistry.java:69) at org.elasticsearch.transport.TcpTransport$RequestHandler.doRun(TcpTransport.java:1544) at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) at org.elasticsearch.common.util.concurrent.EsExecutors$1.execute(EsExecutors.java:110) at org.elasticsearch.transport.TcpTransport.handleRequest(TcpTransport.java:1501) at org.elasticsearch.transport.TcpTransport.messageReceived(TcpTransport.java:1385) at org.elasticsearch.transport.netty4.Netty4MessageChannelHandler.channelRead(Netty4MessageChannelHandler.java:74) at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) at io.netty.handler.codec.ByteToMessageDecoder.fireChannelRead(ByteToMessageDecoder.java:310) at io.netty.handler.codec.ByteToMessageDecoder.fireChannelRead(ByteToMessageDecoder.java:297) at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:413) at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265) at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) at io.netty.channel.ChannelInboundHandlerAdapter.channelRead(ChannelInboundHandlerAdapter.java:86) at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1267) at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1078) at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:489) at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:428) at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265) at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1334) at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:926) at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:134) at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:644) at io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:544) at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:498) at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:458) at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:858) at java.lang.Thread.run(Thread.java:745) `` Using the Search Guard REST Management API, I gotten the relevant current configuration items. **actiongroups** { “CLUSTER\_ALL” : [ “cluster:_" ], “ALL” : [ "indices:_” ], “CRUD” : [ “READ”, “WRITE” ], “SEARCH” : [ “indices:data/read/search\*”, “indices:data/read/msearch\*”, “SUGGEST” ], “MONITOR” : [ “indices:monitor/_" ], “DATA\_ACCESS” : [ "indices:data/_”, “indices:admin/mapping/put” ], “CREATE\_INDEX” : [ “indices:admin/create”, “indices:admin/mapping/put” ], “WRITE” : [ “indices:data/write\*”, “indices:admin/mapping/put” ], “MANAGE\_ALIASES” : [ “indices:admin/aliases\*” ], “READ” : [ “indices:data/read\*” ], “DELETE” : [ “indices:data/write/delete\*” ], “CLUSTER\_COMPOSITE\_OPS” : [ “indices:data/write/bulk”, “indices:admin/aliases\*”, “CLUSTER\_COMPOSITE\_OPS\_RO” ], “CLUSTER\_COMPOSITE\_OPS\_RO” : [ “indices:data/read/mget”, “indices:data/read/msearch”, “indices:data/read/mtv”, “indices:data/read/coordinate-msearch\*”, “indices:admin/aliases/exists\*”, “indices:admin/aliases/get\*” ], “GET” : [ “indices:data/read/get\*”, “indices:data/read/mget\*” ], “MANAGE” : [ “indices:monitor/_", "indices:admin/_” ], “CLUSTER\_MONITOR” : [ “cluster:monitor/_" ], “INDEX” : [ "indices:data/write/index_”, “indices:data/write/update\*”, “indices:admin/mapping/put” ], “SUGGEST” : [ “indices:data/read/suggest\*” ] } `` **roles** { “sg\_all\_access” : { “cluster” : [ “_" ], “indices” : { "_” : { “_" : [ "_” ] } } }, “sg\_kibana” : { “cluster” : [ “CLUSTER\_MONITOR”, “CLUSTER\_COMPOSITE\_OPS\_RO” ], “indices” : { “_" : { "_” : [ “READ”, “indices:admin/mappings/fields/get\*” ] }, “?kibana” : { “_" : [ “ALL” ] } } }, “sg\_public” : { “cluster” : [ “cluster:monitor/main”, “CLUSTER\_COMPOSITE\_OPS\_RO” ] }, “sg\_own\_index” : { “cluster” : [ “CLUSTER\_COMPOSITE\_OPS” ], “indices” : { “${user\_name}” : { "_” : [ “ALL” ] } } }, “sg\_logstash” : { “cluster” : [ “indices:admin/template/get”, “indices:admin/template/put”, “CLUSTER\_MONITOR”, “CLUSTER\_COMPOSITE\_OPS” ], “indices” : { “_beat_” : { “_" : [ “CRUD”, “CREATE\_INDEX” ] }, "logstash-_” : { “_" : [ “CRUD”, “CREATE\_INDEX” ] } } }, “sg\_readall” : { “cluster” : [ “CLUSTER\_COMPOSITE\_OPS\_RO” ], “indices” : { "_” : { “\*” : [ “READ” ] } } } } `` **rolesmapping** { “sg\_all\_access” : { “users” : [ “admin” ] }, “sg\_kibana” : { “users” : [ “kibana” ] }, “sg\_logstash” : { “users” : [ “logstash” ] }, “sg\_readall” : { “users” : [ “ronly1” ] } } `` Any suggestions for overcoming this issue? ---
**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\ **Post date:** [July 12, 2017, 3:21pm UTC](https://forum.search-guard.com/t/running-sgadmin-no-permissions-for-indices-admin-exists/519/2 "2017-07-12T15:21:46Z")
Thats most likely a problem with your ssl certificates. Pls. share elasticsearch.yml and make sure mykeystore.jks contains a client admin certificate (the one which is configured in elasticsearch.yml) see [https://github.com/floragunncom/search-guard-docs/blob/master/sgadmin.md#configuring-the-admin-certificate](https://github.com/floragunncom/search-guard-docs/blob/master/sgadmin.md#configuring-the-admin-certificate) Is this a production issue or just in devel/uat/staging ...? (maybe your certificates have worked prior to SG 14 - if this is the case then we need to document this as a breaking change) > **···** > > > Am 12.07.2017 um 16:14 schrieb Michael \: > > > > OS: Red Hat Enterprise Linux Server release 7.3 > > JVM: openjdk version "1.8.0\_111" > > Search Guard: 5.5.0-14 > > Elasticsearch: 5.5.0-1 > > > > Number of nodes in cluster: 3 > > > > I upgraded from Search Guard 5.3.0 & Elasticsearch 5.3.0 and found I cannot update my Search Guard configuration using sgadmin.sh anymore. Whenever I run the the sgadmin.sh command, I get the following below error: > > > > \> plugins/search-guard-5/tools/sgadmin.sh -h myhost -cd plugins/search-guard-5/sgconfig/ -ks mykeystore.jks -kspass kspass -ts mytruststore.jks -tspass tspass -nhnv -icl > > > > Contacting elasticsearch cluster 'elasticsearch' and wait for YELLOW clusterstate ... > > Clustername: mycluster > > Clusterstate: GREEN > > Number of nodes: 3 > > Number of data nodes: 2 > > ERR: An unexpected ElasticsearchSecurityException occured: no permissions for indices:admin/exists > > Trace: > > ElasticsearchSecurityException[no permissions for indices:admin/exists] > > at com.floragunn.searchguard.filter.SearchGuardFilter.apply(SearchGuardFilter.java:147) > > at org.elasticsearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:168) > > at org.elasticsearch.action.support.TransportAction.execute(TransportAction.java:142) > > at org.elasticsearch.action.support.HandledTransportAction$TransportHandler.messageReceived(HandledTransportAction.java:64) > > at org.elasticsearch.action.support.HandledTransportAction$TransportHandler.messageReceived(HandledTransportAction.java:54) > > at com.floragunn.searchguard.ssl.transport.SearchGuardSSLRequestHandler.messageReceivedDecorate(SearchGuardSSLRequestHandler.java:177) > > at com.floragunn.searchguard.transport.SearchGuardRequestHandler.messageReceivedDecorate(SearchGuardRequestHandler.java:191) > > at com.floragunn.searchguard.ssl.transport.SearchGuardSSLRequestHandler.messageReceived(SearchGuardSSLRequestHandler.java:139) > > at com.floragunn.searchguard.SearchGuardPlugin$2$1.messageReceived(SearchGuardPlugin.java:336) > > at org.elasticsearch.transport.RequestHandlerRegistry.processMessageReceived(RequestHandlerRegistry.java:69) > > at org.elasticsearch.transport.TcpTransport$RequestHandler.doRun(TcpTransport.java:1544) > > at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) > > at org.elasticsearch.common.util.concurrent.EsExecutors$1.execute(EsExecutors.java:110) > > at org.elasticsearch.transport.TcpTransport.handleRequest(TcpTransport.java:1501) > > at org.elasticsearch.transport.TcpTransport.messageReceived(TcpTransport.java:1385) > > at org.elasticsearch.transport.netty4.Netty4MessageChannelHandler.channelRead(Netty4MessageChannelHandler.java:74) > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) > > at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) > > at io.netty.handler.codec.ByteToMessageDecoder.fireChannelRead(ByteToMessageDecoder.java:310) > > at io.netty.handler.codec.ByteToMessageDecoder.fireChannelRead(ByteToMessageDecoder.java:297) > > at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:413) > > at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265) > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) > > at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) > > at io.netty.channel.ChannelInboundHandlerAdapter.channelRead(ChannelInboundHandlerAdapter.java:86) > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) > > at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) > > at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1267) > > at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1078) > > at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:489) > > at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:428) > > at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265) > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) > > at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) > > at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1334) > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) > > at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:926) > > at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:134) > > at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:644) > > at io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:544) > > at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:498) > > at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:458) > > at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:858) > > at java.lang.Thread.run(Thread.java:745) > > > > Using the Search Guard REST Management API, I gotten the relevant current configuration items. > > > > actiongroups > > { > >   "CLUSTER\_ALL" : [ > >     "cluster:\*" > >   ], > >   "ALL" : [ > >     "indices:\*" > >   ], > >   "CRUD" : [ > >     "READ", > >     "WRITE" > >   ], > >   "SEARCH" : [ > >     "indices:data/read/search\*", > >     "indices:data/read/msearch\*", > >     "SUGGEST" > >   ], > >   "MONITOR" : [ > >     "indices:monitor/\*" > >   ], > >   "DATA\_ACCESS" : [ > >     "indices:data/\*", > >     "indices:admin/mapping/put" > >   ], > >   "CREATE\_INDEX" : [ > >     "indices:admin/create", > >     "indices:admin/mapping/put" > >   ], > >   "WRITE" : [ > >     "indices:data/write\*", > >     "indices:admin/mapping/put" > >   ], > >   "MANAGE\_ALIASES" : [ > >     "indices:admin/aliases\*" > >   ], > >   "READ" : [ > >     "indices:data/read\*" > >   ], > >   "DELETE" : [ > >     "indices:data/write/delete\*" > >   ], > >   "CLUSTER\_COMPOSITE\_OPS" : [ > >     "indices:data/write/bulk", > >     "indices:admin/aliases\*", > >     "CLUSTER\_COMPOSITE\_OPS\_RO" > >   ], > >   "CLUSTER\_COMPOSITE\_OPS\_RO" : [ > >     "indices:data/read/mget", > >     "indices:data/read/msearch", > >     "indices:data/read/mtv", > >     "indices:data/read/coordinate-msearch\*", > >     "indices:admin/aliases/exists\*", > >     "indices:admin/aliases/get\*" > >   ], > >   "GET" : [ > >     "indices:data/read/get\*", > >     "indices:data/read/mget\*" > >   ], > >   "MANAGE" : [ > >     "indices:monitor/\*", > >     "indices:admin/\*" > >   ], > >   "CLUSTER\_MONITOR" : [ > >     "cluster:monitor/\*" > >   ], > >   "INDEX" : [ > >     "indices:data/write/index\*", > >     "indices:data/write/update\*", > >     "indices:admin/mapping/put" > >   ], > >   "SUGGEST" : [ > >     "indices:data/read/suggest\*" > >   ] > > } > > > > roles > > { > > > >   "sg\_all\_access" : { > >     "cluster" : [ > >       "\*" > >     ], > >     "indices" : { > >       "\*" : { > >         "\*" : [ > >           "\*" > >         ] > >       } > >     } > >   }, > >   "sg\_kibana" : { > >     "cluster" : [ > >       "CLUSTER\_MONITOR", > >       "CLUSTER\_COMPOSITE\_OPS\_RO" > >     ], > >     "indices" : { > >       "\*" : { > >         "\*" : [ > >           "READ", > >           "indices:admin/mappings/fields/get\*" > >         ] > >       }, > >       "?kibana" : { > >         "\*" : [ > >           "ALL" > >         ] > >       } > >     } > >   }, > >   "sg\_public" : { > >     "cluster" : [ > >       "cluster:monitor/main", > >       "CLUSTER\_COMPOSITE\_OPS\_RO" > >     ] > >   }, > >   "sg\_own\_index" : { > >     "cluster" : [ > >       "CLUSTER\_COMPOSITE\_OPS" > >     ], > >     "indices" : { > >       "${user\_name}" : { > >         "\*" : [ > >           "ALL" > >         ] > >       } > >     } > >   }, > >   "sg\_logstash" : { > >     "cluster" : [ > >       "indices:admin/template/get", > >       "indices:admin/template/put", > >       "CLUSTER\_MONITOR", > >       "CLUSTER\_COMPOSITE\_OPS" > >     ], > >     "indices" : { > >       "\*beat\*" : { > >         "\*" : [ > >           "CRUD", > >           "CREATE\_INDEX" > >         ] > >       }, > >       "logstash-\*" : { > >         "\*" : [ > >           "CRUD", > >           "CREATE\_INDEX" > >         ] > >       } > >     } > >   }, > >   "sg\_readall" : { > >     "cluster" : [ > >       "CLUSTER\_COMPOSITE\_OPS\_RO" > >     ], > >     "indices" : { > >       "\*" : { > >         "\*" : [ > >           "READ" > >         ] > >       } > >     } > >   } > > } > > > > rolesmapping > > { > >   "sg\_all\_access" : { > >     "users" : [ > >       "admin" > >     ] > >   }, > >   "sg\_kibana" : { > >     "users" : [ > >       "kibana" > >     ] > >   }, > >   "sg\_logstash" : { > >     "users" : [ > >       "logstash" > >     ] > >   }, > >   "sg\_readall" : { > >     "users" : [ > >       "ronly1" > >     ] > >   } > > } > > > > Any suggestions for overcoming this issue? > > > > -- > > You received this message because you are subscribed to the Google Groups "Search Guard" group. > > To unsubscribe from this group and stop receiving emails from it, send an email to search-guard+unsubscribe@googlegroups.com. > > To post to this group, send email to search-guard@googlegroups.com. > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/e643a359-df02-4989-b163-eb3c13b6d460%40googlegroups.com\](https://groups.google.com/d/msgid/search-guard/e643a359-df02-4989-b163-eb3c13b6d460%40googlegroups.com%5C). > > For more options, visit [https://groups.google.com/d/optout\](https://groups.google.com/d/optout%5C). ---
**Author:** ![Michael](https://avatars.discourse-cdn.com/v4/letter/m/4bbf92/32.png) [@Michael](https://forum.search-guard.com/u/Michael)\ **Post date:** [July 13, 2017, 2:43am UTC](https://forum.search-guard.com/t/running-sgadmin-no-permissions-for-indices-admin-exists/519/3 "2017-07-13T02:43:04Z")
This is a proof of concept, but one of the acceptance criteria is to ensure TLS is implemented. Therefore, the configuration feels like it’s for production. The root, signing CA, client and node certificates were generated using [https://floragunn.com/tls-certificate-generator/](https://floragunn.com/tls-certificate-generator/) and are valid at least until 2019. Here’s the relevant snippet in elasticsearch.yml # --------------------------------- Search Guard SSL Configuration ------------- > **···** > > # > > searchguard.ssl.http.enabled: true > searchguard.ssl.http.keystore\_filepath: node1-keystore.jks > searchguard.ssl.http.keystore\_password: node1pass > searchguard.ssl.http.truststore\_filepath: mytruststore.jks > searchguard.ssl.http.truststore\_password: tspass > searchguard.ssl.transport.keystore\_filepath: node1-keystore.jks > searchguard.ssl.transport.keystore\_password: node1pass > searchguard.ssl.transport.truststore\_filepath: mytruststore.jks > searchguard.ssl.transport.truststore\_password: tspass > searchguard.ssl.transport.enforce\_hostname\_verification: false > searchguard.authcz.admin\_dn: > > - CN=sgadmin > - CN=node1-keystore > > `` > > Here’s the relevant keystores > > > keytool -list -keystore plugins/search-guard-5/sgconfig/sgadmin-keystore.jks -storepass sgpass > > Keystore type: JKS > Keystore provider: SUN > > Your keystore contains 1 entry > > cn=sgadmin, Apr 5, 2017, PrivateKeyEntry, > Certificate fingerprint (SHA1): **:** : **:** : **:** : **:** : **:** : **:** : **:** : **:** : **:** : **:** > > > keytool -list -keystore plugins/search-guard-5/sgconfig/node1-keystore.jks -storepass node1pass > > Keystore type: JKS > Keystore provider: SUN > > Your keystore contains 1 entry > > cn=node1-keystore, Apr 5, 2017, PrivateKeyEntry, > Certificate fingerprint (SHA1): **:** : **:** : **:** : **:** : **:** : **:** : **:** : **:** : **:** : **:** > > > keytool -list -keystore plugins/search-guard-5/sgconfig/mytruststore.jks -storepass tspass > > Keystore type: JKS > Keystore provider: SUN > > Your keystore contains 1 entry > > root-ca-chain, Apr 5, 2017, trustedCertEntry, > Certificate fingerprint (SHA1): **:** : **:** : **:** : **:** : **:** : **:** : **:** : **:** : **:** : **:** > > `` > > The keystores were not changed as part of the upgrade and the same sgadmin command provided was able to run sgadmin.sh in SG 5.3.0 and ES 5.3.0. > > On Thursday, 13 July 2017 00:14:25 UTC+10, Michael wrote: > > > OS: Red Hat Enterprise Linux Server release 7.3 > > > JVM: openjdk version “1.8.0\_111” > > > Search Guard: 5.5.0-14 > > > Elasticsearch: 5.5.0-1 > > > > > > Number of nodes in cluster: 3 > > > > > > I upgraded from Search Guard 5.3.0 & Elasticsearch 5.3.0 and found I cannot update my Search Guard configuration using sgadmin.sh anymore. Whenever I run the the sgadmin.sh command, I get the following below error: > > > > > > > > > > plugins/search-guard-5/tools/sgadmin.sh -h myhost -cd plugins/search-guard-5/sgconfig/ -ks mykeystore.jks -kspass kspass -ts mytruststore.jks -tspass tspass -nhnv -icl > > > > Contacting elasticsearch cluster ‘elasticsearch’ and wait for YELLOW clusterstate … > > Clustername: mycluster > > Clusterstate: GREEN > > Number of nodes: 3 > > Number of data nodes: 2 > > ERR: An unexpected ElasticsearchSecurityException occured: no permissions for indices:admin/exists > > Trace: > > ElasticsearchSecurityException[no permissions for indices:admin/exists] > > at com.floragunn.searchguard.filter.SearchGuardFilter.apply(SearchGuardFilter.java:147) > > at org.elasticsearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:168) > > at org.elasticsearch.action.support.TransportAction.execute(TransportAction.java:142) > > at org.elasticsearch.action.support.HandledTransportAction$TransportHandler.messageReceived(HandledTransportAction.java:64) > > at org.elasticsearch.action.support.HandledTransportAction$TransportHandler.messageReceived(HandledTransportAction.java:54) > > at com.floragunn.searchguard.ssl.transport.SearchGuardSSLRequestHandler.messageReceivedDecorate(SearchGuardSSLRequestHandler.java:177) > > at com.floragunn.searchguard.transport.SearchGuardRequestHandler.messageReceivedDecorate(SearchGuardRequestHandler.java:191) > > at com.floragunn.searchguard.ssl.transport.SearchGuardSSLRequestHandler.messageReceived(SearchGuardSSLRequestHandler.java:139) > > at com.floragunn.searchguard.SearchGuardPlugin$2$1.messageReceived(SearchGuardPlugin.java:336) > > at org.elasticsearch.transport.RequestHandlerRegistry.processMessageReceived(RequestHandlerRegistry.java:69) > > at org.elasticsearch.transport.TcpTransport$RequestHandler.doRun(TcpTransport.java:1544) > > at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) > > at org.elasticsearch.common.util.concurrent.EsExecutors$1.execute(EsExecutors.java:110) > > at org.elasticsearch.transport.TcpTransport.handleRequest(TcpTransport.java:1501) > > at org.elasticsearch.transport.TcpTransport.messageReceived(TcpTransport.java:1385) > > at org.elasticsearch.transport.netty4.Netty4MessageChannelHandler.channelRead(Netty4MessageChannelHandler.java:74) > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) > > at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) > > at io.netty.handler.codec.ByteToMessageDecoder.fireChannelRead(ByteToMessageDecoder.java:310) > > at io.netty.handler.codec.ByteToMessageDecoder.fireChannelRead(ByteToMessageDecoder.java:297) > > at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:413) > > at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265) > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) > > at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) > > at io.netty.channel.ChannelInboundHandlerAdapter.channelRead(ChannelInboundHandlerAdapter.java:86) > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) > > at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) > > at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1267) > > at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1078) > > at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:489) > > at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:428) > > at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265) > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) > > at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) > > at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1334) > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) > > at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:926) > > at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:134) > > at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:644) > > at io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:544) > > at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:498) > > at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:458) > > at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:858) > > at java.lang.Thread.run(Thread.java:745) > > > `` > > > > > > Using the Search Guard REST Management API, I gotten the relevant current configuration items. > > > > > > **actiongroups** > > > { > > “CLUSTER\_ALL” : [ > > “cluster:_" > > ], > > “ALL” : [ > > "indices:_” > > ], > > “CRUD” : [ > > “READ”, > > “WRITE” > > ], > > “SEARCH” : [ > > “indices:data/read/search\*”, > > “indices:data/read/msearch\*”, > > “SUGGEST” > > ], > > “MONITOR” : [ > > “indices:monitor/_" > > ], > > “DATA\_ACCESS” : [ > > "indices:data/_”, > > “indices:admin/mapping/put” > > ], > > “CREATE\_INDEX” : [ > > “indices:admin/create”, > > “indices:admin/mapping/put” > > ], > > “WRITE” : [ > > “indices:data/write\*”, > > “indices:admin/mapping/put” > > ], > > “MANAGE\_ALIASES” : [ > > “indices:admin/aliases\*” > > ], > > “READ” : [ > > “indices:data/read\*” > > ], > > “DELETE” : [ > > “indices:data/write/delete\*” > > ], > > “CLUSTER\_COMPOSITE\_OPS” : [ > > “indices:data/write/bulk”, > > “indices:admin/aliases\*”, > > “CLUSTER\_COMPOSITE\_OPS\_RO” > > ], > > “CLUSTER\_COMPOSITE\_OPS\_RO” : [ > > “indices:data/read/mget”, > > “indices:data/read/msearch”, > > “indices:data/read/mtv”, > > “indices:data/read/coordinate-msearch\*”, > > “indices:admin/aliases/exists\*”, > > “indices:admin/aliases/get\*” > > ], > > “GET” : [ > > “indices:data/read/get\*”, > > “indices:data/read/mget\*” > > ], > > “MANAGE” : [ > > “indices:monitor/_", > > "indices:admin/_” > > ], > > “CLUSTER\_MONITOR” : [ > > “cluster:monitor/_" > > ], > > “INDEX” : [ > > "indices:data/write/index_”, > > “indices:data/write/update\*”, > > “indices:admin/mapping/put” > > ], > > “SUGGEST” : [ > > “indices:data/read/suggest\*” > > ] > > } > > > `` > > > > > > **roles** > > > { > > > > “sg\_all\_access” : { > > “cluster” : [ > > “_" > > ], > > “indices” : { > > "_” : { > > “_" : [ > > "_” > > ] > > } > > } > > }, > > “sg\_kibana” : { > > “cluster” : [ > > “CLUSTER\_MONITOR”, > > “CLUSTER\_COMPOSITE\_OPS\_RO” > > ], > > “indices” : { > > “_" : { > > "_” : [ > > “READ”, > > “indices:admin/mappings/fields/get\*” > > ] > > }, > > “?kibana” : { > > “_" : [ > > “ALL” > > ] > > } > > } > > }, > > “sg\_public” : { > > “cluster” : [ > > “cluster:monitor/main”, > > “CLUSTER\_COMPOSITE\_OPS\_RO” > > ] > > }, > > “sg\_own\_index” : { > > “cluster” : [ > > “CLUSTER\_COMPOSITE\_OPS” > > ], > > “indices” : { > > “${user\_name}” : { > > "_” : [ > > “ALL” > > ] > > } > > } > > }, > > “sg\_logstash” : { > > “cluster” : [ > > “indices:admin/template/get”, > > “indices:admin/template/put”, > > “CLUSTER\_MONITOR”, > > “CLUSTER\_COMPOSITE\_OPS” > > ], > > “indices” : { > > “_beat_” : { > > “_" : [ > > “CRUD”, > > “CREATE\_INDEX” > > ] > > }, > > "logstash-_” : { > > “_" : [ > > “CRUD”, > > “CREATE\_INDEX” > > ] > > } > > } > > }, > > “sg\_readall” : { > > “cluster” : [ > > “CLUSTER\_COMPOSITE\_OPS\_RO” > > ], > > “indices” : { > > "_” : { > > “\*” : [ > > “READ” > > ] > > } > > } > > } > > } > > > `` > > > > > > **rolesmapping** > > > { > > “sg\_all\_access” : { > > “users” : [ > > “admin” > > ] > > }, > > “sg\_kibana” : { > > “users” : [ > > “kibana” > > ] > > }, > > “sg\_logstash” : { > > “users” : [ > > “logstash” > > ] > > }, > > “sg\_readall” : { > > “users” : [ > > “ronly1” > > ] > > } > > } > > > `` > > > > > > Any suggestions for overcoming this issue? > > > ---
**Author:** ![Michael](https://avatars.discourse-cdn.com/v4/letter/m/4bbf92/32.png) [@Michael](https://forum.search-guard.com/u/Michael)\ **Post date:** [July 13, 2017, 4:34am UTC](https://forum.search-guard.com/t/running-sgadmin-no-permissions-for-indices-admin-exists/519/4 "2017-07-13T04:34:11Z")
So a bit of a breakthrough / workaround - when I include the keystore and truststore passwords as part of the sgadmin command on the command line, it fails with the reported error. If I exported the same passwords as environment variables SG\_KS\_PASS and SG\_TS\_PASS, then sgadmin works as expected. > **···** > > On Thursday, 13 July 2017 00:14:25 UTC+10, Michael wrote: > > > OS: Red Hat Enterprise Linux Server release 7.3 > > > JVM: openjdk version “1.8.0\_111” > > > Search Guard: 5.5.0-14 > > > Elasticsearch: 5.5.0-1 > > > > > > Number of nodes in cluster: 3 > > > > > > I upgraded from Search Guard 5.3.0 & Elasticsearch 5.3.0 and found I cannot update my Search Guard configuration using sgadmin.sh anymore. Whenever I run the the sgadmin.sh command, I get the following below error: > > > > > > > > > > plugins/search-guard-5/tools/sgadmin.sh -h myhost -cd plugins/search-guard-5/sgconfig/ -ks mykeystore.jks -kspass kspass -ts mytruststore.jks -tspass tspass -nhnv -icl > > > > Contacting elasticsearch cluster ‘elasticsearch’ and wait for YELLOW clusterstate … > > Clustername: mycluster > > Clusterstate: GREEN > > Number of nodes: 3 > > Number of data nodes: 2 > > ERR: An unexpected ElasticsearchSecurityException occured: no permissions for indices:admin/exists > > Trace: > > ElasticsearchSecurityException[no permissions for indices:admin/exists] > > at com.floragunn.searchguard.filter.SearchGuardFilter.apply(SearchGuardFilter.java:147) > > at org.elasticsearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:168) > > at org.elasticsearch.action.support.TransportAction.execute(TransportAction.java:142) > > at org.elasticsearch.action.support.HandledTransportAction$TransportHandler.messageReceived(HandledTransportAction.java:64) > > at org.elasticsearch.action.support.HandledTransportAction$TransportHandler.messageReceived(HandledTransportAction.java:54) > > at com.floragunn.searchguard.ssl.transport.SearchGuardSSLRequestHandler.messageReceivedDecorate(SearchGuardSSLRequestHandler.java:177) > > at com.floragunn.searchguard.transport.SearchGuardRequestHandler.messageReceivedDecorate(SearchGuardRequestHandler.java:191) > > at com.floragunn.searchguard.ssl.transport.SearchGuardSSLRequestHandler.messageReceived(SearchGuardSSLRequestHandler.java:139) > > at com.floragunn.searchguard.SearchGuardPlugin$2$1.messageReceived(SearchGuardPlugin.java:336) > > at org.elasticsearch.transport.RequestHandlerRegistry.processMessageReceived(RequestHandlerRegistry.java:69) > > at org.elasticsearch.transport.TcpTransport$RequestHandler.doRun(TcpTransport.java:1544) > > at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) > > at org.elasticsearch.common.util.concurrent.EsExecutors$1.execute(EsExecutors.java:110) > > at org.elasticsearch.transport.TcpTransport.handleRequest(TcpTransport.java:1501) > > at org.elasticsearch.transport.TcpTransport.messageReceived(TcpTransport.java:1385) > > at org.elasticsearch.transport.netty4.Netty4MessageChannelHandler.channelRead(Netty4MessageChannelHandler.java:74) > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) > > at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) > > at io.netty.handler.codec.ByteToMessageDecoder.fireChannelRead(ByteToMessageDecoder.java:310) > > at io.netty.handler.codec.ByteToMessageDecoder.fireChannelRead(ByteToMessageDecoder.java:297) > > at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:413) > > at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265) > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) > > at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) > > at io.netty.channel.ChannelInboundHandlerAdapter.channelRead(ChannelInboundHandlerAdapter.java:86) > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) > > at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) > > at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1267) > > at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1078) > > at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:489) > > at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:428) > > at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265) > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) > > at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) > > at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1334) > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) > > at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:926) > > at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:134) > > at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:644) > > at io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:544) > > at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:498) > > at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:458) > > at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:858) > > at java.lang.Thread.run(Thread.java:745) > > > `` > > > > > > Using the Search Guard REST Management API, I gotten the relevant current configuration items. > > > > > > **actiongroups** > > > { > > “CLUSTER\_ALL” : [ > > “cluster:_" > > ], > > “ALL” : [ > > "indices:_” > > ], > > “CRUD” : [ > > “READ”, > > “WRITE” > > ], > > “SEARCH” : [ > > “indices:data/read/search\*”, > > “indices:data/read/msearch\*”, > > “SUGGEST” > > ], > > “MONITOR” : [ > > “indices:monitor/_" > > ], > > “DATA\_ACCESS” : [ > > "indices:data/_”, > > “indices:admin/mapping/put” > > ], > > “CREATE\_INDEX” : [ > > “indices:admin/create”, > > “indices:admin/mapping/put” > > ], > > “WRITE” : [ > > “indices:data/write\*”, > > “indices:admin/mapping/put” > > ], > > “MANAGE\_ALIASES” : [ > > “indices:admin/aliases\*” > > ], > > “READ” : [ > > “indices:data/read\*” > > ], > > “DELETE” : [ > > “indices:data/write/delete\*” > > ], > > “CLUSTER\_COMPOSITE\_OPS” : [ > > “indices:data/write/bulk”, > > “indices:admin/aliases\*”, > > “CLUSTER\_COMPOSITE\_OPS\_RO” > > ], > > “CLUSTER\_COMPOSITE\_OPS\_RO” : [ > > “indices:data/read/mget”, > > “indices:data/read/msearch”, > > “indices:data/read/mtv”, > > “indices:data/read/coordinate-msearch\*”, > > “indices:admin/aliases/exists\*”, > > “indices:admin/aliases/get\*” > > ], > > “GET” : [ > > “indices:data/read/get\*”, > > “indices:data/read/mget\*” > > ], > > “MANAGE” : [ > > “indices:monitor/_", > > "indices:admin/_” > > ], > > “CLUSTER\_MONITOR” : [ > > “cluster:monitor/_" > > ], > > “INDEX” : [ > > "indices:data/write/index_”, > > “indices:data/write/update\*”, > > “indices:admin/mapping/put” > > ], > > “SUGGEST” : [ > > “indices:data/read/suggest\*” > > ] > > } > > > `` > > > > > > **roles** > > > { > > > > “sg\_all\_access” : { > > “cluster” : [ > > “_" > > ], > > “indices” : { > > "_” : { > > “_" : [ > > "_” > > ] > > } > > } > > }, > > “sg\_kibana” : { > > “cluster” : [ > > “CLUSTER\_MONITOR”, > > “CLUSTER\_COMPOSITE\_OPS\_RO” > > ], > > “indices” : { > > “_" : { > > "_” : [ > > “READ”, > > “indices:admin/mappings/fields/get\*” > > ] > > }, > > “?kibana” : { > > “_" : [ > > “ALL” > > ] > > } > > } > > }, > > “sg\_public” : { > > “cluster” : [ > > “cluster:monitor/main”, > > “CLUSTER\_COMPOSITE\_OPS\_RO” > > ] > > }, > > “sg\_own\_index” : { > > “cluster” : [ > > “CLUSTER\_COMPOSITE\_OPS” > > ], > > “indices” : { > > “${user\_name}” : { > > "_” : [ > > “ALL” > > ] > > } > > } > > }, > > “sg\_logstash” : { > > “cluster” : [ > > “indices:admin/template/get”, > > “indices:admin/template/put”, > > “CLUSTER\_MONITOR”, > > “CLUSTER\_COMPOSITE\_OPS” > > ], > > “indices” : { > > “_beat_” : { > > “_" : [ > > “CRUD”, > > “CREATE\_INDEX” > > ] > > }, > > "logstash-_” : { > > “_" : [ > > “CRUD”, > > “CREATE\_INDEX” > > ] > > } > > } > > }, > > “sg\_readall” : { > > “cluster” : [ > > “CLUSTER\_COMPOSITE\_OPS\_RO” > > ], > > “indices” : { > > "_” : { > > “\*” : [ > > “READ” > > ] > > } > > } > > } > > } > > > `` > > > > > > **rolesmapping** > > > { > > “sg\_all\_access” : { > > “users” : [ > > “admin” > > ] > > }, > > “sg\_kibana” : { > > “users” : [ > > “kibana” > > ] > > }, > > “sg\_logstash” : { > > “users” : [ > > “logstash” > > ] > > }, > > “sg\_readall” : { > > “users” : [ > > “ronly1” > > ] > > } > > } > > > `` > > > > > > Any suggestions for overcoming this issue? > > > ---
**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\ **Post date:** [July 13, 2017, 11:51am UTC](https://forum.search-guard.com/t/running-sgadmin-no-permissions-for-indices-admin-exists/519/5 "2017-07-13T11:51:43Z")
thats pretty strange, i will investigate this > **···** > > > Am 13.07.2017 um 06:34 schrieb Michael \: > > > > So a bit of a breakthrough / workaround - when I include the keystore and truststore passwords as part of the sgadmin command on the command line, it fails with the reported error. > > If I exported the same passwords as environment variables SG\_KS\_PASS and SG\_TS\_PASS, then sgadmin works as expected. > > > > On Thursday, 13 July 2017 00:14:25 UTC+10, Michael wrote: > > OS: Red Hat Enterprise Linux Server release 7.3 > > JVM: openjdk version "1.8.0\_111" > > Search Guard: 5.5.0-14 > > Elasticsearch: 5.5.0-1 > > > > Number of nodes in cluster: 3 > > > > I upgraded from Search Guard 5.3.0 & Elasticsearch 5.3.0 and found I cannot update my Search Guard configuration using sgadmin.sh anymore. Whenever I run the the sgadmin.sh command, I get the following below error: > > > > \> plugins/search-guard-5/tools/sgadmin.sh -h myhost -cd plugins/search-guard-5/sgconfig/ -ks mykeystore.jks -kspass kspass -ts mytruststore.jks -tspass tspass -nhnv -icl > > > > Contacting elasticsearch cluster 'elasticsearch' and wait for YELLOW clusterstate ... > > Clustername: mycluster > > Clusterstate: GREEN > > Number of nodes: 3 > > Number of data nodes: 2 > > ERR: An unexpected ElasticsearchSecurityException occured: no permissions for indices:admin/exists > > Trace: > > ElasticsearchSecurityException[no permissions for indices:admin/exists] > > at com.floragunn.searchguard.filter.SearchGuardFilter.apply(SearchGuardFilter.java:147) > > at org.elasticsearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:168) > > at org.elasticsearch.action.support.TransportAction.execute(TransportAction.java:142) > > at org.elasticsearch.action.support.HandledTransportAction$TransportHandler.messageReceived(HandledTransportAction.java:64) > > at org.elasticsearch.action.support.HandledTransportAction$TransportHandler.messageReceived(HandledTransportAction.java:54) > > at com.floragunn.searchguard.ssl.transport.SearchGuardSSLRequestHandler.messageReceivedDecorate(SearchGuardSSLRequestHandler.java:177) > > at com.floragunn.searchguard.transport.SearchGuardRequestHandler.messageReceivedDecorate(SearchGuardRequestHandler.java:191) > > at com.floragunn.searchguard.ssl.transport.SearchGuardSSLRequestHandler.messageReceived(SearchGuardSSLRequestHandler.java:139) > > at com.floragunn.searchguard.SearchGuardPlugin$2$1.messageReceived(SearchGuardPlugin.java:336) > > at org.elasticsearch.transport.RequestHandlerRegistry.processMessageReceived(RequestHandlerRegistry.java:69) > > at org.elasticsearch.transport.TcpTransport$RequestHandler.doRun(TcpTransport.java:1544) > > at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) > > at org.elasticsearch.common.util.concurrent.EsExecutors$1.execute(EsExecutors.java:110) > > at org.elasticsearch.transport.TcpTransport.handleRequest(TcpTransport.java:1501) > > at org.elasticsearch.transport.TcpTransport.messageReceived(TcpTransport.java:1385) > > at org.elasticsearch.transport.netty4.Netty4MessageChannelHandler.channelRead(Netty4MessageChannelHandler.java:74) > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) > > at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) > > at io.netty.handler.codec.ByteToMessageDecoder.fireChannelRead(ByteToMessageDecoder.java:310) > > at io.netty.handler.codec.ByteToMessageDecoder.fireChannelRead(ByteToMessageDecoder.java:297) > > at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:413) > > at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265) > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) > > at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) > > at io.netty.channel.ChannelInboundHandlerAdapter.channelRead(ChannelInboundHandlerAdapter.java:86) > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) > > at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) > > at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1267) > > at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1078) > > at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:489) > > at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:428) > > at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265) > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) > > at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) > > at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1334) > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) > > at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:926) > > at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:134) > > at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:644) > > at io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:544) > > at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:498) > > at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:458) > > at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:858) > > at java.lang.Thread.run(Thread.java:745) > > > > Using the Search Guard REST Management API, I gotten the relevant current configuration items. > > > > actiongroups > > { > >   "CLUSTER\_ALL" : [ > >     "cluster:\*" > >   ], > >   "ALL" : [ > >     "indices:\*" > >   ], > >   "CRUD" : [ > >     "READ", > >     "WRITE" > >   ], > >   "SEARCH" : [ > >     "indices:data/read/search\*", > >     "indices:data/read/msearch\*", > >     "SUGGEST" > >   ], > >   "MONITOR" : [ > >     "indices:monitor/\*" > >   ], > >   "DATA\_ACCESS" : [ > >     "indices:data/\*", > >     "indices:admin/mapping/put" > >   ], > >   "CREATE\_INDEX" : [ > >     "indices:admin/create", > >     "indices:admin/mapping/put" > >   ], > >   "WRITE" : [ > >     "indices:data/write\*", > >     "indices:admin/mapping/put" > >   ], > >   "MANAGE\_ALIASES" : [ > >     "indices:admin/aliases\*" > >   ], > >   "READ" : [ > >     "indices:data/read\*" > >   ], > >   "DELETE" : [ > >     "indices:data/write/delete\*" > >   ], > >   "CLUSTER\_COMPOSITE\_OPS" : [ > >     "indices:data/write/bulk", > >     "indices:admin/aliases\*", > >     "CLUSTER\_COMPOSITE\_OPS\_RO" > >   ], > >   "CLUSTER\_COMPOSITE\_OPS\_RO" : [ > >     "indices:data/read/mget", > >     "indices:data/read/msearch", > >     "indices:data/read/mtv", > >     "indices:data/read/coordinate-msearch\*", > >     "indices:admin/aliases/exists\*", > >     "indices:admin/aliases/get\*" > >   ], > >   "GET" : [ > >     "indices:data/read/get\*", > >     "indices:data/read/mget\*" > >   ], > >   "MANAGE" : [ > >     "indices:monitor/\*", > >     "indices:admin/\*" > >   ], > >   "CLUSTER\_MONITOR" : [ > >     "cluster:monitor/\*" > >   ], > >   "INDEX" : [ > >     "indices:data/write/index\*", > >     "indices:data/write/update\*", > >     "indices:admin/mapping/put" > >   ], > >   "SUGGEST" : [ > >     "indices:data/read/suggest\*" > >   ] > > } > > > > roles > > { > > > >   "sg\_all\_access" : { > >     "cluster" : [ > >       "\*" > >     ], > >     "indices" : { > >       "\*" : { > >         "\*" : [ > >           "\*" > >         ] > >       } > >     } > >   }, > >   "sg\_kibana" : { > >     "cluster" : [ > >       "CLUSTER\_MONITOR", > >       "CLUSTER\_COMPOSITE\_OPS\_RO" > >     ], > >     "indices" : { > >       "\*" : { > >         "\*" : [ > >           "READ", > >           "indices:admin/mappings/fields/get\*" > >         ] > >       }, > >       "?kibana" : { > >         "\*" : [ > >           "ALL" > >         ] > >       } > >     } > >   }, > >   "sg\_public" : { > >     "cluster" : [ > >       "cluster:monitor/main", > >       "CLUSTER\_COMPOSITE\_OPS\_RO" > >     ] > >   }, > >   "sg\_own\_index" : { > >     "cluster" : [ > >       "CLUSTER\_COMPOSITE\_OPS" > >     ], > >     "indices" : { > >       "${user\_name}" : { > >         "\*" : [ > >           "ALL" > >         ] > >       } > >     } > >   }, > >   "sg\_logstash" : { > >     "cluster" : [ > >       "indices:admin/template/get", > >       "indices:admin/template/put", > >       "CLUSTER\_MONITOR", > >       "CLUSTER\_COMPOSITE\_OPS" > >     ], > >     "indices" : { > >       "\*beat\*" : { > >         "\*" : [ > >           "CRUD", > >           "CREATE\_INDEX" > >         ] > >       }, > >       "logstash-\*" : { > >         "\*" : [ > >           "CRUD", > >           "CREATE\_INDEX" > >         ] > >       } > >     } > >   }, > >   "sg\_readall" : { > >     "cluster" : [ > >       "CLUSTER\_COMPOSITE\_OPS\_RO" > >     ], > >     "indices" : { > >       "\*" : { > >         "\*" : [ > >           "READ" > >         ] > >       } > >     } > >   } > > } > > > > rolesmapping > > { > >   "sg\_all\_access" : { > >     "users" : [ > >       "admin" > >     ] > >   }, > >   "sg\_kibana" : { > >     "users" : [ > >       "kibana" > >     ] > >   }, > >   "sg\_logstash" : { > >     "users" : [ > >       "logstash" > >     ] > >   }, > >   "sg\_readall" : { > >     "users" : [ > >       "ronly1" > >     ] > >   } > > } > > > > Any suggestions for overcoming this issue? > > > > -- > > You received this message because you are subscribed to the Google Groups "Search Guard" group. > > To unsubscribe from this group and stop receiving emails from it, send an email to search-guard+unsubscribe@googlegroups.com. > > To post to this group, send email to search-guard@googlegroups.com. > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/68e68964-b57c-42a0-8998-1e3981875c73%40googlegroups.com\](https://groups.google.com/d/msgid/search-guard/68e68964-b57c-42a0-8998-1e3981875c73%40googlegroups.com%5C). > > For more options, visit [https://groups.google.com/d/optout\](https://groups.google.com/d/optout%5C). ---
**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\ **Post date:** [July 13, 2017, 12:06pm UTC](https://forum.search-guard.com/t/running-sgadmin-no-permissions-for-indices-admin-exists/519/6 "2017-07-13T12:06:48Z")
see also [https://github.com/floragunncom/search-guard/issues/366](https://github.com/floragunncom/search-guard/issues/366) > **···** > > On Thursday, 13 July 2017 04:43:04 UTC+2, Michael wrote: > > > This is a proof of concept, but one of the acceptance criteria is to ensure TLS is implemented. Therefore, the configuration feels like it’s for production. The root, signing CA, client and node certificates were generated using [https://floragunn.com/tls-certificate-generator/](https://floragunn.com/tls-certificate-generator/) and are valid at least until 2019. > > > > > > Here’s the relevant snippet in elasticsearch.yml > > > # --------------------------------- Search Guard SSL Configuration ------------- > > > > # > > > > searchguard.ssl.http.enabled: true > > searchguard.ssl.http.keystore\_filepath: node1-keystore.jks > > searchguard.ssl.http.keystore\_password: node1pass > > searchguard.ssl.http.truststore\_filepath: mytruststore.jks > > searchguard.ssl.http.truststore\_password: tspass > > searchguard.ssl.transport.keystore\_filepath: node1-keystore.jks > > searchguard.ssl.transport.keystore\_password: node1pass > > searchguard.ssl.transport.truststore\_filepath: mytruststore.jks > > searchguard.ssl.transport.truststore\_password: tspass > > searchguard.ssl.transport.enforce\_hostname\_verification: false > > searchguard.authcz.admin\_dn: > > > > - CN=sgadmin > > - CN=node1-keystore > > > `` > > > > > > Here’s the relevant keystores > > > > > > > keytool -list -keystore plugins/search-guard-5/sgconfig/sgadmin-keystore.jks -storepass sgpass > > > > Keystore type: JKS > > Keystore provider: SUN > > > > Your keystore contains 1 entry > > > > cn=sgadmin, Apr 5, 2017, PrivateKeyEntry, > > Certificate fingerprint (SHA1): **:** : **:** : **:** : **:** : **:** : **:** : **:** : **:** : **:** : **:** > > > > > keytool -list -keystore plugins/search-guard-5/sgconfig/node1-keystore.jks -storepass node1pass > > > > Keystore type: JKS > > Keystore provider: SUN > > > > Your keystore contains 1 entry > > > > cn=node1-keystore, Apr 5, 2017, PrivateKeyEntry, > > Certificate fingerprint (SHA1): **:** : **:** : **:** : **:** : **:** : **:** : **:** : **:** : **:** : **:** > > > > > keytool -list -keystore plugins/search-guard-5/sgconfig/mytruststore.jks -storepass tspass > > > > Keystore type: JKS > > Keystore provider: SUN > > > > Your keystore contains 1 entry > > > > root-ca-chain, Apr 5, 2017, trustedCertEntry, > > Certificate fingerprint (SHA1): **:** : **:** : **:** : **:** : **:** : **:** : **:** : **:** : **:** : **:** > > > `` > > > > > > The keystores were not changed as part of the upgrade and the same sgadmin command provided was able to run sgadmin.sh in SG 5.3.0 and ES 5.3.0. > > > > > > > > > On Thursday, 13 July 2017 00:14:25 UTC+10, Michael wrote: > > > > > OS: Red Hat Enterprise Linux Server release 7.3 > > > > JVM: openjdk version “1.8.0\_111” > > > > Search Guard: 5.5.0-14 > > > > Elasticsearch: 5.5.0-1 > > > > > > > > Number of nodes in cluster: 3 > > > > > > > > I upgraded from Search Guard 5.3.0 & Elasticsearch 5.3.0 and found I cannot update my Search Guard configuration using sgadmin.sh anymore. Whenever I run the the sgadmin.sh command, I get the following below error: > > > > > > > > > > > > > plugins/search-guard-5/tools/sgadmin.sh -h myhost -cd plugins/search-guard-5/sgconfig/ -ks mykeystore.jks -kspass kspass -ts mytruststore.jks -tspass tspass -nhnv -icl > > > > > > Contacting elasticsearch cluster ‘elasticsearch’ and wait for YELLOW clusterstate … > > > Clustername: mycluster > > > Clusterstate: GREEN > > > Number of nodes: 3 > > > Number of data nodes: 2 > > > ERR: An unexpected ElasticsearchSecurityException occured: no permissions for indices:admin/exists > > > Trace: > > > ElasticsearchSecurityException[no permissions for indices:admin/exists] > > > at com.floragunn.searchguard.filter.SearchGuardFilter.apply(SearchGuardFilter.java:147) > > > at org.elasticsearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:168) > > > at org.elasticsearch.action.support.TransportAction.execute(TransportAction.java:142) > > > at org.elasticsearch.action.support.HandledTransportAction$TransportHandler.messageReceived(HandledTransportAction.java:64) > > > at org.elasticsearch.action.support.HandledTransportAction$TransportHandler.messageReceived(HandledTransportAction.java:54) > > > at com.floragunn.searchguard.ssl.transport.SearchGuardSSLRequestHandler.messageReceivedDecorate(SearchGuardSSLRequestHandler.java:177) > > > at com.floragunn.searchguard.transport.SearchGuardRequestHandler.messageReceivedDecorate(SearchGuardRequestHandler.java:191) > > > at com.floragunn.searchguard.ssl.transport.SearchGuardSSLRequestHandler.messageReceived(SearchGuardSSLRequestHandler.java:139) > > > at com.floragunn.searchguard.SearchGuardPlugin$2$1.messageReceived(SearchGuardPlugin.java:336) > > > at org.elasticsearch.transport.RequestHandlerRegistry.processMessageReceived(RequestHandlerRegistry.java:69) > > > at org.elasticsearch.transport.TcpTransport$RequestHandler.doRun(TcpTransport.java:1544) > > > at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) > > > at org.elasticsearch.common.util.concurrent.EsExecutors$1.execute(EsExecutors.java:110) > > > at org.elasticsearch.transport.TcpTransport.handleRequest(TcpTransport.java:1501) > > > at org.elasticsearch.transport.TcpTransport.messageReceived(TcpTransport.java:1385) > > > at org.elasticsearch.transport.netty4.Netty4MessageChannelHandler.channelRead(Netty4MessageChannelHandler.java:74) > > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) > > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) > > > at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) > > > at io.netty.handler.codec.ByteToMessageDecoder.fireChannelRead(ByteToMessageDecoder.java:310) > > > at io.netty.handler.codec.ByteToMessageDecoder.fireChannelRead(ByteToMessageDecoder.java:297) > > > at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:413) > > > at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265) > > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) > > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) > > > at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) > > > at io.netty.channel.ChannelInboundHandlerAdapter.channelRead(ChannelInboundHandlerAdapter.java:86) > > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) > > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) > > > at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) > > > at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1267) > > > at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1078) > > > at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:489) > > > at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:428) > > > at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265) > > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) > > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) > > > at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) > > > at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1334) > > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) > > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) > > > at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:926) > > > at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:134) > > > at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:644) > > > at io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:544) > > > at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:498) > > > at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:458) > > > at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:858) > > > at java.lang.Thread.run(Thread.java:745) > > > > `` > > > > > > > > Using the Search Guard REST Management API, I gotten the relevant current configuration items. > > > > > > > > **actiongroups** > > > > { > > > “CLUSTER\_ALL” : [ > > > “cluster:_" > > > ], > > > “ALL” : [ > > > "indices:_” > > > ], > > > “CRUD” : [ > > > “READ”, > > > “WRITE” > > > ], > > > “SEARCH” : [ > > > “indices:data/read/search\*”, > > > “indices:data/read/msearch\*”, > > > “SUGGEST” > > > ], > > > “MONITOR” : [ > > > “indices:monitor/_" > > > ], > > > “DATA\_ACCESS” : [ > > > "indices:data/_”, > > > “indices:admin/mapping/put” > > > ], > > > “CREATE\_INDEX” : [ > > > “indices:admin/create”, > > > “indices:admin/mapping/put” > > > ], > > > “WRITE” : [ > > > “indices:data/write\*”, > > > “indices:admin/mapping/put” > > > ], > > > “MANAGE\_ALIASES” : [ > > > “indices:admin/aliases\*” > > > ], > > > “READ” : [ > > > “indices:data/read\*” > > > ], > > > “DELETE” : [ > > > “indices:data/write/delete\*” > > > ], > > > “CLUSTER\_COMPOSITE\_OPS” : [ > > > “indices:data/write/bulk”, > > > “indices:admin/aliases\*”, > > > “CLUSTER\_COMPOSITE\_OPS\_RO” > > > ], > > > “CLUSTER\_COMPOSITE\_OPS\_RO” : [ > > > “indices:data/read/mget”, > > > “indices:data/read/msearch”, > > > “indices:data/read/mtv”, > > > “indices:data/read/coordinate-msearch\*”, > > > “indices:admin/aliases/exists\*”, > > > “indices:admin/aliases/get\*” > > > ], > > > “GET” : [ > > > “indices:data/read/get\*”, > > > “indices:data/read/mget\*” > > > ], > > > “MANAGE” : [ > > > “indices:monitor/_", > > > "indices:admin/_” > > > ], > > > “CLUSTER\_MONITOR” : [ > > > “cluster:monitor/_" > > > ], > > > “INDEX” : [ > > > "indices:data/write/index_”, > > > “indices:data/write/update\*”, > > > “indices:admin/mapping/put” > > > ], > > > “SUGGEST” : [ > > > “indices:data/read/suggest\*” > > > ] > > > } > > > > `` > > > > > > > > **roles** > > > > { > > > > > > “sg\_all\_access” : { > > > “cluster” : [ > > > “_" > > > ], > > > “indices” : { > > > "_” : { > > > “_" : [ > > > "_” > > > ] > > > } > > > } > > > }, > > > “sg\_kibana” : { > > > “cluster” : [ > > > “CLUSTER\_MONITOR”, > > > “CLUSTER\_COMPOSITE\_OPS\_RO” > > > ], > > > “indices” : { > > > “_" : { > > > "_” : [ > > > “READ”, > > > “indices:admin/mappings/fields/get\*” > > > ] > > > }, > > > “?kibana” : { > > > “_" : [ > > > “ALL” > > > ] > > > } > > > } > > > }, > > > “sg\_public” : { > > > “cluster” : [ > > > “cluster:monitor/main”, > > > “CLUSTER\_COMPOSITE\_OPS\_RO” > > > ] > > > }, > > > “sg\_own\_index” : { > > > “cluster” : [ > > > “CLUSTER\_COMPOSITE\_OPS” > > > ], > > > “indices” : { > > > “${user\_name}” : { > > > "_” : [ > > > “ALL” > > > ] > > > } > > > } > > > }, > > > “sg\_logstash” : { > > > “cluster” : [ > > > “indices:admin/template/get”, > > > “indices:admin/template/put”, > > > “CLUSTER\_MONITOR”, > > > “CLUSTER\_COMPOSITE\_OPS” > > > ], > > > “indices” : { > > > “_beat_” : { > > > “_" : [ > > > “CRUD”, > > > “CREATE\_INDEX” > > > ] > > > }, > > > "logstash-_” : { > > > “_" : [ > > > “CRUD”, > > > “CREATE\_INDEX” > > > ] > > > } > > > } > > > }, > > > “sg\_readall” : { > > > “cluster” : [ > > > “CLUSTER\_COMPOSITE\_OPS\_RO” > > > ], > > > “indices” : { > > > "_” : { > > > “\*” : [ > > > “READ” > > > ] > > > } > > > } > > > } > > > } > > > > `` > > > > > > > > **rolesmapping** > > > > { > > > “sg\_all\_access” : { > > > “users” : [ > > > “admin” > > > ] > > > }, > > > “sg\_kibana” : { > > > “users” : [ > > > “kibana” > > > ] > > > }, > > > “sg\_logstash” : { > > > “users” : [ > > > “logstash” > > > ] > > > }, > > > “sg\_readall” : { > > > “users” : [ > > > “ronly1” > > > ] > > > } > > > } > > > > `` > > > > > > > > Any suggestions for overcoming this issue? > > > > ---
**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\ **Post date:** [July 13, 2017, 7:58pm UTC](https://forum.search-guard.com/t/running-sgadmin-no-permissions-for-indices-admin-exists/519/7 "2017-07-13T19:58:09Z")
i am glad that it is working for you but i cannot reproduce this (for me it always working with command line passwords as well as environment passwords) Maybe you passwords contains special characters which interfere with shell expansion or globbing (especially & and ! signs are good candidates here) For your original issue there is also now one on github: [https://github.com/floragunncom/search-guard/issues/366](https://github.com/floragunncom/search-guard/issues/366) Long story short: Use admin client certificates instead of node certificates for sgadmin > **···** > > On Thursday, 13 July 2017 06:34:11 UTC+2, Michael wrote: > > > So a bit of a breakthrough / workaround - when I include the keystore and truststore passwords as part of the sgadmin command on the command line, it fails with the reported error. > > If I exported the same passwords as environment variables SG\_KS\_PASS and SG\_TS\_PASS, then sgadmin works as expected. > > > > > > On Thursday, 13 July 2017 00:14:25 UTC+10, Michael wrote: > > > > > OS: Red Hat Enterprise Linux Server release 7.3 > > > > JVM: openjdk version “1.8.0\_111” > > > > Search Guard: 5.5.0-14 > > > > Elasticsearch: 5.5.0-1 > > > > > > > > Number of nodes in cluster: 3 > > > > > > > > I upgraded from Search Guard 5.3.0 & Elasticsearch 5.3.0 and found I cannot update my Search Guard configuration using sgadmin.sh anymore. Whenever I run the the sgadmin.sh command, I get the following below error: > > > > > > > > > > > > > plugins/search-guard-5/tools/sgadmin.sh -h myhost -cd plugins/search-guard-5/sgconfig/ -ks mykeystore.jks -kspass kspass -ts mytruststore.jks -tspass tspass -nhnv -icl > > > > > > Contacting elasticsearch cluster ‘elasticsearch’ and wait for YELLOW clusterstate … > > > Clustername: mycluster > > > Clusterstate: GREEN > > > Number of nodes: 3 > > > Number of data nodes: 2 > > > ERR: An unexpected ElasticsearchSecurityException occured: no permissions for indices:admin/exists > > > Trace: > > > ElasticsearchSecurityException[no permissions for indices:admin/exists] > > > at com.floragunn.searchguard.filter.SearchGuardFilter.apply(SearchGuardFilter.java:147) > > > at org.elasticsearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:168) > > > at org.elasticsearch.action.support.TransportAction.execute(TransportAction.java:142) > > > at org.elasticsearch.action.support.HandledTransportAction$TransportHandler.messageReceived(HandledTransportAction.java:64) > > > at org.elasticsearch.action.support.HandledTransportAction$TransportHandler.messageReceived(HandledTransportAction.java:54) > > > at com.floragunn.searchguard.ssl.transport.SearchGuardSSLRequestHandler.messageReceivedDecorate(SearchGuardSSLRequestHandler.java:177) > > > at com.floragunn.searchguard.transport.SearchGuardRequestHandler.messageReceivedDecorate(SearchGuardRequestHandler.java:191) > > > at com.floragunn.searchguard.ssl.transport.SearchGuardSSLRequestHandler.messageReceived(SearchGuardSSLRequestHandler.java:139) > > > at com.floragunn.searchguard.SearchGuardPlugin$2$1.messageReceived(SearchGuardPlugin.java:336) > > > at org.elasticsearch.transport.RequestHandlerRegistry.processMessageReceived(RequestHandlerRegistry.java:69) > > > at org.elasticsearch.transport.TcpTransport$RequestHandler.doRun(TcpTransport.java:1544) > > > at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) > > > at org.elasticsearch.common.util.concurrent.EsExecutors$1.execute(EsExecutors.java:110) > > > at org.elasticsearch.transport.TcpTransport.handleRequest(TcpTransport.java:1501) > > > at org.elasticsearch.transport.TcpTransport.messageReceived(TcpTransport.java:1385) > > > at org.elasticsearch.transport.netty4.Netty4MessageChannelHandler.channelRead(Netty4MessageChannelHandler.java:74) > > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) > > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) > > > at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) > > > at io.netty.handler.codec.ByteToMessageDecoder.fireChannelRead(ByteToMessageDecoder.java:310) > > > at io.netty.handler.codec.ByteToMessageDecoder.fireChannelRead(ByteToMessageDecoder.java:297) > > > at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:413) > > > at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265) > > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) > > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) > > > at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) > > > at io.netty.channel.ChannelInboundHandlerAdapter.channelRead(ChannelInboundHandlerAdapter.java:86) > > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) > > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) > > > at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) > > > at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1267) > > > at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1078) > > > at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:489) > > > at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:428) > > > at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265) > > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) > > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) > > > at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) > > > at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1334) > > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) > > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) > > > at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:926) > > > at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:134) > > > at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:644) > > > at io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:544) > > > at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:498) > > > at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:458) > > > at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:858) > > > at java.lang.Thread.run(Thread.java:745) > > > > `` > > > > > > > > Using the Search Guard REST Management API, I gotten the relevant current configuration items. > > > > > > > > **actiongroups** > > > > { > > > “CLUSTER\_ALL” : [ > > > “cluster:_" > > > ], > > > “ALL” : [ > > > "indices:_” > > > ], > > > “CRUD” : [ > > > “READ”, > > > “WRITE” > > > ], > > > “SEARCH” : [ > > > “indices:data/read/search\*”, > > > “indices:data/read/msearch\*”, > > > “SUGGEST” > > > ], > > > “MONITOR” : [ > > > “indices:monitor/_" > > > ], > > > “DATA\_ACCESS” : [ > > > "indices:data/_”, > > > “indices:admin/mapping/put” > > > ], > > > “CREATE\_INDEX” : [ > > > “indices:admin/create”, > > > “indices:admin/mapping/put” > > > ], > > > “WRITE” : [ > > > “indices:data/write\*”, > > > “indices:admin/mapping/put” > > > ], > > > “MANAGE\_ALIASES” : [ > > > “indices:admin/aliases\*” > > > ], > > > “READ” : [ > > > “indices:data/read\*” > > > ], > > > “DELETE” : [ > > > “indices:data/write/delete\*” > > > ], > > > “CLUSTER\_COMPOSITE\_OPS” : [ > > > “indices:data/write/bulk”, > > > “indices:admin/aliases\*”, > > > “CLUSTER\_COMPOSITE\_OPS\_RO” > > > ], > > > “CLUSTER\_COMPOSITE\_OPS\_RO” : [ > > > “indices:data/read/mget”, > > > “indices:data/read/msearch”, > > > “indices:data/read/mtv”, > > > “indices:data/read/coordinate-msearch\*”, > > > “indices:admin/aliases/exists\*”, > > > “indices:admin/aliases/get\*” > > > ], > > > “GET” : [ > > > “indices:data/read/get\*”, > > > “indices:data/read/mget\*” > > > ], > > > “MANAGE” : [ > > > “indices:monitor/_", > > > "indices:admin/_” > > > ], > > > “CLUSTER\_MONITOR” : [ > > > “cluster:monitor/_" > > > ], > > > “INDEX” : [ > > > "indices:data/write/index_”, > > > “indices:data/write/update\*”, > > > “indices:admin/mapping/put” > > > ], > > > “SUGGEST” : [ > > > “indices:data/read/suggest\*” > > > ] > > > } > > > > `` > > > > > > > > **roles** > > > > { > > > > > > “sg\_all\_access” : { > > > “cluster” : [ > > > “_" > > > ], > > > “indices” : { > > > "_” : { > > > “_" : [ > > > "_” > > > ] > > > } > > > } > > > }, > > > “sg\_kibana” : { > > > “cluster” : [ > > > “CLUSTER\_MONITOR”, > > > “CLUSTER\_COMPOSITE\_OPS\_RO” > > > ], > > > “indices” : { > > > “_" : { > > > "_” : [ > > > “READ”, > > > “indices:admin/mappings/fields/get\*” > > > ] > > > }, > > > “?kibana” : { > > > “_" : [ > > > “ALL” > > > ] > > > } > > > } > > > }, > > > “sg\_public” : { > > > “cluster” : [ > > > “cluster:monitor/main”, > > > “CLUSTER\_COMPOSITE\_OPS\_RO” > > > ] > > > }, > > > “sg\_own\_index” : { > > > “cluster” : [ > > > “CLUSTER\_COMPOSITE\_OPS” > > > ], > > > “indices” : { > > > “${user\_name}” : { > > > "_” : [ > > > “ALL” > > > ] > > > } > > > } > > > }, > > > “sg\_logstash” : { > > > “cluster” : [ > > > “indices:admin/template/get”, > > > “indices:admin/template/put”, > > > “CLUSTER\_MONITOR”, > > > “CLUSTER\_COMPOSITE\_OPS” > > > ], > > > “indices” : { > > > “_beat_” : { > > > “_" : [ > > > “CRUD”, > > > “CREATE\_INDEX” > > > ] > > > }, > > > "logstash-_” : { > > > “_" : [ > > > “CRUD”, > > > “CREATE\_INDEX” > > > ] > > > } > > > } > > > }, > > > “sg\_readall” : { > > > “cluster” : [ > > > “CLUSTER\_COMPOSITE\_OPS\_RO” > > > ], > > > “indices” : { > > > "_” : { > > > “\*” : [ > > > “READ” > > > ] > > > } > > > } > > > } > > > } > > > > `` > > > > > > > > **rolesmapping** > > > > { > > > “sg\_all\_access” : { > > > “users” : [ > > > “admin” > > > ] > > > }, > > > “sg\_kibana” : { > > > “users” : [ > > > “kibana” > > > ] > > > }, > > > “sg\_logstash” : { > > > “users” : [ > > > “logstash” > > > ] > > > }, > > > “sg\_readall” : { > > > “users” : [ > > > “ronly1” > > > ] > > > } > > > } > > > > `` > > > > > > > > Any suggestions for overcoming this issue? > > > >