Solution after becoming "read_only_allow_delete" : "true"

[peropero]

03/09/2019

Thank you for your cooperation.
I have the same problem.

Failed to create new users and roles

Hi, I’m using Elasticsearch 6.7 with search guard. Everything was good until the Elasticsearch hard disk reaches to 90% limitation. Elasticsearch goes to block writing in all indices. Using the following command I try to re-enable writing: PUT _all/_settings { “index.blocks.read_only_allow_delete”: null } However, this command does not work since the following error: { “error”: { “root_cause”: [ { “type”: “security_exception”, “reason”: “no permissions for and User [name=myuser, …

The following command written by @jkressin didn’t work either.
Of course, the index is deleted to free up space.

curl -k \
  --cert "/path/to/admin-cert.pem" \
  --key "/path/to/admin-key.pem"  \
  -XPUT "https://sgssl-0.example.com:9200/_all/_settings" \
  -H 'Content-Type: application/json' \
  -d '{ "index.blocks.read_only_allow_delete": null }'

↓Execution result↓

{"error":{"root_cause":[{"type":"security_exception","reason":"no permissions for [] and User [name=admin, roles=[admin, admintest], requestedTenant=null]"}],"type":"security_exception","reason":"no permissions for [] and User [name=admin, roles=[admin, admintest], requestedTenant=null]"},"status":403}

Why can’t I use the following commands after installing SerachGuard?
Please tell me the solution.

PUT myindex / _settings
{
“Index.blocks.read_only_allow_delete”: null
}

curl -XPUT -H "Content-Type: application/json" http://example:9200/<index_name>/_settings -d '{"index.blocks.read_only_allow_delete": null}'

This command will succeed if <index_name> is specified other than “_all” and “searchguard”.
So, if you can unblock “searchguard”, this problem will be solved.

If this command cannot be executed,
Your log will not be able to be written, and Kibana will display an error.

BestRegards.

[jkressin]

@peropero

{“error”:{“root_cause”:[{“type”:“security_exception”,“reason”:“no permissions for and User [name=admin, roles=[admin, admintest], requestedTenant=null]”}],“type”:“security_exception”,“reason”:“no permissions for and User [name=admin, roles=[admin, admintest], requestedTenant=null]”},“status”:403}

This error that you posted cannot be produced by the curl statement you posted:

@peropero

curl -k \ –cert “/path/to/admin-cert.pem” \ –key “/path/to/admin-key.pem” \ -XPUT “https://sgssl-0.example.com:9200/_all/_settings” \ -H ‘Content-Type: application/json’ \ -d ‘{ “index.blocks.read_only_allow_delete”: null }’

This curl command uses the SG admin certificate instead of a user account to bypass all SG security restrictions. The error message displays the admin user account, which is not used in the curl.

Are you sure you are using the correct paths to your admin certficate when using the curl call?

--cert "/path/to/admin-cert.pem" \
  --key "/path/to/admin-key.pem"  \