Sg_admin.sh not working

Hi, while running sg_admin.sh it is auto closing with Error:could not load main class com.floragunn.searchguard.tools.SearchGuardAdmin

Installed through install plugin command, version 7.10.2
Created demo certificates with install_demo_configuration.sh

My Major concern is to change/delete admin pwd/account, so changed pwd hash in internal_users.yml file to update these config trying to run sg_admin.

Is there any alternate to delete/modify admin user from SG?

SG_ADMIN.SH File content :

#!/bin/bash
SCRIPT_PATH="${BASH_SOURCE[0]}"
if ! [ -x "$(command -v realpath)" ]; then
    if [ -L "$SCRIPT_PATH" ]; then
        
        [ -x "$(command -v readlink)" ] || { echo "Not able to resolve symlink. Install realpath or readlink." 1>&2;exit 1; }
        
        # try readlink (-f not needed because we know its a symlink)
        DIR="$( cd "$( dirname $(readlink "$SCRIPT_PATH") )" && pwd -P)"
    else
        DIR="$( cd "$( dirname "$SCRIPT_PATH" )" && pwd -P)"
    fi
else
    DIR="$( cd "$( dirname "$(realpath "$SCRIPT_PATH")" )" && pwd -P)"
fi

BIN_PATH="java"

if [ -z "$JAVA_HOME" ]; then
    echo "WARNING: JAVA_HOME not set, will use $(which $BIN_PATH)" 1>&2
else
    BIN_PATH="$JAVA_HOME/bin/java"
fi

"$BIN_PATH" $JAVA_OPTS -Dio.netty.tryReflectionSetAccessible=false -Dio.netty.noUnsafe=true -Dorg.apache.logging.log4j.simplelog.StatusLogger.level=OFF -cp "$DIR/../*:$DIR/../../../lib/*:$DIR/../deps/*" com.floragunn.searchguard.tools.SearchGuardAdmin "$@"

Hi.

My Major concern is to change/delete admin pwd/account, so changed pwd hash in internal_users.yml file to update these config trying to run sg_admin.

I don’t understand what do you worry about. Could you please elaborate more on it?

@sivakumarreddy2026
Can you list the files in your plugin/search-guard/tools. directory? The demo install should have created a demo file that can be used. But there doesn’t seem to be a sg_admin.sh.

Can you also paste the command you use to execute the script and the full output that is produced.

There might also be inconsistency with JDK, as ES now comes with its own. If you have the sgadmin_demo.sh script you could update it as follows to use the ES JDK:

#!/bin/bash
export JAVA_HOME=.../elasticsearch/elasticsearch-7.10.2/jdk
".../elasticsearch/elasticsearch-7.10.2/plugins/search-guard-7/tools/sgadmin.sh" -cd ".../elasticsearch/elasticsearch-7.10.2/plugins/search-guard-7/sgconfig" -icl -key ".../elasticsearch/elasticsearch-7.10.2/config/kirk-key.pem" -cert ".../elasticsearch/elasticsearch-7.10.2/config/kirk.pem" -cacert ".../elasticsearch/elasticsearch-7.10.2/config/root-ca.pem" -nhnv

image

content in sgadmin_demo.sh
#!/bin/bash
“/f/ELK/7.10.2/elasticsearch-7.10.2/plugins/search-guard-7/tools/sgadmin.sh” -cd “/f/ELK/7.10.2/elasticsearch-7.10.2/plugins/search-guard-7/sgconfig” -icl -key “/f/ELK/7.10.2/elasticsearch-7.10.2/config/kirk-key.pem” -cert “/f/ELK/7.10.2/elasticsearch-7.10.2/config/kirk.pem” -cacert “/f/ELK/7.10.2/elasticsearch-7.10.2/config/root-ca.pem” -nhnv

content in sgadmin.sh
#!/bin/bash
SCRIPT_PATH=“${BASH_SOURCE[0]}”
if ! [ -x “$(command -v realpath)” ]; then
if [ -L “$SCRIPT_PATH” ]; then

    [ -x "$(command -v readlink)" ] || { echo "Not able to resolve symlink. Install realpath or readlink." 1>&2;exit 1; }
    
    # try readlink (-f not needed because we know its a symlink)
    DIR="$( cd "$( dirname $(readlink "$SCRIPT_PATH") )" && pwd -P)"
else
    DIR="$( cd "$( dirname "$SCRIPT_PATH" )" && pwd -P)"
fi

else
DIR=“$( cd “$( dirname “$(realpath “$SCRIPT_PATH”)” )” && pwd -P)”
fi

BIN_PATH=“java”

if [ -z “$JAVA_HOME” ]; then
echo “WARNING: JAVA_HOME not set, will use $(which $BIN_PATH)” 1>&2
else
BIN_PATH=“$JAVA_HOME/bin/java”
fi

“$BIN_PATH” $JAVA_OPTS -Dio.netty.tryReflectionSetAccessible=false -Dio.netty.noUnsafe=true -Dorg.apache.logging.log4j.simplelog.StatusLogger.level=OFF -cp “$DIR/…/:$DIR/…/…/…/lib/:$DIR/…/deps/*” com.floragunn.searchguard.tools.SearchGuardAdmin “$@”

Can you try to update sgadmin_demo.sh script as per the earlier message and run sgadmin_demo.sh (no additional parameters are necessary, as you can see it already points to the relevant certs etc)

ERROR
Error: Could not find or load main class com.floragunn.searchguard.tools.SearchGuardAdmin
Caused by: java.lang.ClassNotFoundException: com.floragunn.searchguard.tools.SearchGuardAdmin

Script inside sgdemo_admin.sh
#!/bin/bash
export JAVA_HOME=F:/ELK/7.11.2/elasticsearch-7.11.2/jdk
“F:/ELK/7.11.2/elasticsearch-7.11.2/plugins/search-guard-7/tools/sgadmin.sh” -cd “F:/ELK/7.11.2/elasticsearch-7.11.2/plugins/search-guard-7/sgconfig” -icl -key “F:/ELK/7.11.2/elasticsearch-7.11.2/config/kirk-key.pem” -cert “F:/ELK/7.11.2/elasticsearch-7.11.2/config/kirk.pem” -cacert “F:/ELK/7.11.2/elasticsearch-7.11.2/config/root-ca.pem” -nhnv

Could you please post the full error log here (redact any sensitive details), also what OS do you use?

ERROR
Error: Could not find or load main class com.floragunn.searchguard.tools.SearchGuardAdmin
Caused by: java.lang.ClassNotFoundException: com.floragunn.searchguard.tools.SearchGuardAdmin

that is the only error coming in bash command line

WE are using windows 10 oS

If you are on windows is there any reason you are not using sgadmin.bat file instead? This seems to be an issue with the shell on windows.

content in sgadmin.bat
@echo off
set SCRIPT_DIR=%~dp0
“%JAVA_HOME%\bin\java” -Dio.netty.tryReflectionSetAccessible=false -Dio.netty.noUnsafe=true -Dorg.apache.logging.log4j.simplelog.StatusLogger.level=OFF -cp “%SCRIPT_DIR%....\search-guard-ssl*;%SCRIPT_DIR%..\deps*;%SCRIPT_DIR%..*;%SCRIPT_DIR%......\lib*” com.floragunn.searchguard.tools.SearchGuardAdmin %*

are we need to change anything??

ERROR
Search Guard Admin v7
ERR: Parsing failed. Reason: Specify at least -ks or -cert

You will need to provide all the same parameters as with previous script:
-cd “F:/ELK/7.11.2/elasticsearch-7.11.2/plugins/search-guard-7/sgconfig” -icl -key “F:/ELK/7.11.2/elasticsearch-7.11.2/config/kirk-key.pem” -cert “F:/ELK/7.11.2/elasticsearch-7.11.2/config/kirk.pem” -cacert “F:/ELK/7.11.2/elasticsearch-7.11.2/config/root-ca.pem” -nhnv

script in sgadmin.bat
@echo off
set SCRIPT_DIR=%~dp0
“%JAVA_HOME%\bin\java” -Dio.netty.tryReflectionSetAccessible=false -Dio.netty.noUnsafe=true -Dorg.apache.logging.log4j.simplelog.StatusLogger.level=OFF -cp “%SCRIPT_DIR%....\search-guard-ssl*;%SCRIPT_DIR%..\deps*;%SCRIPT_DIR%..*;%SCRIPT_DIR%......\lib*” com.floragunn.searchguard.tools.SearchGuardAdmin %* -cd “F:/ELK/7.11.2/elasticsearch-7.11.2/plugins/search-guard-7/sgconfig” -icl -key “F:/ELK/7.11.2/elasticsearch-7.11.2/config/kirk-key.pem” -cert “F:/ELK/7.11.2/elasticsearch-7.11.2/config/kirk.pem” -cacert “F:/ELK/7.11.2/elasticsearch-7.11.2/config/root-ca.pem” -nhnv

error

@sivakumarreddy2026 currently its complaining about the certificate,

I would recommend to create new certs using offline tool described here

You can also test the current certs using CSR Decoder and Certificate Decoder | CSR Checker | Certificate Checker any invalid characters will generate errors.

Then try to rerun the script again

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.