# Steps to add users **URL:** \ **Category:** Search Guard\ **Created:** [January 25, 2018, 8:56am UTC](https://forum.search-guard.com/t/steps-to-add-users/757 "2018-01-25T08:56:27Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Kernel](https://avatars.discourse-cdn.com/v4/letter/k/7ea924/32.png) [@Kernel](https://forum.search-guard.com/u/Kernel)\ **Post date:** [January 25, 2018, 8:56am UTC](https://forum.search-guard.com/t/steps-to-add-users/757/1 "2018-01-25T08:56:27Z")
When asking questions, please provide the following information: - Search Guard and Elasticsearch version: 6.1 - Installed and used enterprise modules, if any : No - JVM version and operating system version: Java: openjdk version “1.8.0\_151” OpenJDK Runtime Environment (build 1.8.0\_151-b12) OpenJDK 64-Bit Server VM (build 25.151-b12, mixed mode) Distro: CentOS Linux release 7.4.1708 (Core) - Search Guard configuration files: Modified hash /sgconfig/ files - Elasticsearch log messages on debug level - Other installed Elasticsearch or Kibana plugins, if any : No Can you please make a tutorial into documentation step by step HOW to add new users and roles to it without errors? For example, i changed the hash for the demo users and applied with sgadmin, that it works but when i want to change the password from SG Tenant web ui for the user logstash i can’t the submit button is faded, so I tried to put readonly: false at roles and internal\_users. yml sg\_all\_access: readonly: false but without any luck, i still can’t edit the password, the button submit is still faded. PLEASE, update the documentation to be more friendly for users who dosen’t work with ELK, step by step it will be awesome Thanks ---
**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\ **Post date:** [January 25, 2018, 1:40pm UTC](https://forum.search-guard.com/t/steps-to-add-users/757/2 "2018-01-25T13:40:31Z")
Managing internal users is described here: > **[Internal users database](https://docs.search-guard.com/latest/internal-users-database)** > > How to store and manage Search Guard users directly in Elasticsearch by using the Internal Users Database. The readonly / reserved flag is described here: > **[Access Control](https://docs.search-guard.com/latest/rest-api-access-control)** > > Configure role-based access control to different endpoints and methods of the REST API. Agreed, the usage of the readonly / reserved flag should also be described in the Users, Roles and Permissions chapter, we will update the docs. So in your case just set the readonly flag to false for the resources that you want to make editable in the config GUI. For example, the logstash user in internal\_users.yml. What in particular are you struggling with or is unclear in the documentation? Your input helps to make the docs better. Thanks! > **···** > > On Thursday, January 25, 2018 at 9:56:27 AM UTC+1, Kernel wrote: > > > When asking questions, please provide the following information: > > > - Search Guard and Elasticsearch version: 6.1 > > > - Installed and used enterprise modules, if any : No > > > - JVM version and operating system version: > > > Java: > > > openjdk version “1.8.0\_151” > > > OpenJDK Runtime Environment (build 1.8.0\_151-b12) > > > OpenJDK 64-Bit Server VM (build 25.151-b12, mixed mode) > > > Distro: > > > CentOS Linux release 7.4.1708 (Core) > > > - Search Guard configuration files: Modified hash /sgconfig/ files > > > - Elasticsearch log messages on debug level > > > - Other installed Elasticsearch or Kibana plugins, if any : No > > > > > > Can you please make a tutorial into documentation step by step HOW to add new users and roles to it without errors? > > > > > > For example, i changed the hash for the demo users and applied with sgadmin, that it works but when i want to change the password from SG Tenant web ui for the user logstash i can’t the submit button is faded, so I tried to put readonly: false at roles and internal\_users. yml > > > > > > sg\_all\_access: > > > readonly: false > > > > > > > > > but without any luck, i still can’t edit the password, the button submit is still faded. > > > > > > PLEASE, update the documentation to be more friendly for users who dosen’t work with ELK, step by step it will be awesome > > > > > > Thanks ---
**Author:** ![Lucas\_Mello](https://avatars.discourse-cdn.com/v4/letter/l/87869e/32.png) [@Lucas\_Mello](https://forum.search-guard.com/u/Lucas_Mello)\ **Post date:** [January 30, 2018, 4:58pm UTC](https://forum.search-guard.com/t/steps-to-add-users/757/3 "2018-01-30T16:58:55Z")
Hey @Jochen Kressin When I add the users to sg\_internal\_users.yml, what should I do? I’ve tried reloading the sg\_admin, but it says my Elastic Search is not running (I’m using the docker version with Search Guard). Will connect to localhost:9300 … done ERR: Cannot connect to Elasticsearch. Please refer to elasticsearch logfile for more information Trace: NoNodeAvailableException[None of the configured nodes are available: [{#transport#-1}{V1h9M4nbR9SI9wFGit9vGA}{localhost}{127.0.0.1:9300}]] at org.elasticsearch.client.transport.TransportClientNodesService.ensureNodesAreAvailable(TransportClientNodesService.java:347) at org.elasticsearch.client.transport.TransportClientNodesService.execute(TransportClientNodesService.java:245) at org.elasticsearch.client.transport.TransportProxyClient.execute(TransportProxyClient.java:60) at org.elasticsearch.client.transport.TransportClient.doExecute(TransportClient.java:360) at org.elasticsearch.client.support.AbstractClient.execute(AbstractClient.java:405) at org.elasticsearch.client.support.AbstractClient.execute(AbstractClient.java:394) at com.floragunn.searchguard.tools.SearchGuardAdmin.main0(SearchGuardAdmin.java:406) at com.floragunn.searchguard.tools.SearchGuardAdmin.main(SearchGuardAdmin.java:120) Any help would be appreciated! Thanks! > **···** > > Em quinta-feira, 25 de janeiro de 2018 11:40:31 UTC-2, Jochen Kressin escreveu: > > > Managing internal users is described here: > > > [http://docs.search-guard.com/latest/internal-users-database](http://docs.search-guard.com/latest/internal-users-database) > > > > > > The readonly / reserved flag is described here: > > > > > > [http://docs.search-guard.com/latest/rest-api-access-control](http://docs.search-guard.com/latest/rest-api-access-control) > > > > > > Agreed, the usage of the readonly / reserved flag should also be described in the Users, Roles and Permissions chapter, we will update the docs. > > > > > > So in your case just set the readonly flag to false for the resources that you want to make editable in the config GUI. For example, the logstash user in internal\_users.yml. > > > > > > What in particular are you struggling with or is unclear in the documentation? Your input helps to make the docs better. > > > > > > Thanks! > > > > On Thursday, January 25, 2018 at 9:56:27 AM UTC+1, Kernel wrote: > > > > > When asking questions, please provide the following information: > > > > - Search Guard and Elasticsearch version: 6.1 > > > > - Installed and used enterprise modules, if any : No > > > > - JVM version and operating system version: > > > > Java: > > > > openjdk version “1.8.0\_151” > > > > OpenJDK Runtime Environment (build 1.8.0\_151-b12) > > > > OpenJDK 64-Bit Server VM (build 25.151-b12, mixed mode) > > > > Distro: > > > > CentOS Linux release 7.4.1708 (Core) > > > > - Search Guard configuration files: Modified hash /sgconfig/ files > > > > - Elasticsearch log messages on debug level > > > > - Other installed Elasticsearch or Kibana plugins, if any : No > > > > > > > > Can you please make a tutorial into documentation step by step HOW to add new users and roles to it without errors? > > > > > > > > For example, i changed the hash for the demo users and applied with sgadmin, that it works but when i want to change the password from SG Tenant web ui for the user logstash i can’t the submit button is faded, so I tried to put readonly: false at roles and internal\_users. yml > > > > > > > > sg\_all\_access: > > > > readonly: false > > > > > > > > > > > > but without any luck, i still can’t edit the password, the button submit is still faded. > > > > > > > > PLEASE, update the documentation to be more friendly for users who dosen’t work with ELK, step by step it will be awesome > > > > > > > > Thanks ---
**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\ **Post date:** [January 30, 2018, 5:27pm UTC](https://forum.search-guard.com/t/steps-to-add-users/757/4 "2018-01-30T17:27:48Z")
Did you try to connect to the Docker container from your local machine, or did you actually log into the container? If you want to connect from your local machine, make sure to EXPOSE the Elastic ports (default 9200 REST and 9300 transport), and also publish them to the host when executing docker run: > **[docker run](https://docs.docker.com/engine/reference/commandline/run/#options)** > > Learn all there is to know about the docker run command and how to use it in the Docker CLI. (see the --publish option) For example to bind 9300 from the container to 9300 on your local machine you would use: -p 9300:9300 > **···** > > On Tuesday, January 30, 2018 at 5:58:56 PM UTC+1, Lucas Mello wrote: > > > Hey @Jochen Kressin > > > When I add the users to sg\_internal\_users.yml, what should I do? I’ve tried reloading the sg\_admin, but it says my Elastic Search is not running (I’m using the docker version with Search Guard). > > > > > > Will connect to localhost:9300 … done > > > ERR: Cannot connect to Elasticsearch. Please refer to elasticsearch logfile for more information > > > Trace: > > > NoNodeAvailableException[None of the configured nodes are available: [{#transport#-1}{V1h9M4nbR9SI9wFGit9vGA}{localhost}{127.0.0.1:9300}]] > > > at org.elasticsearch.client.transport.TransportClientNodesService.ensureNodesAreAvailable(TransportClientNodesService.java:347) > > > at org.elasticsearch.client.transport.TransportClientNodesService.execute(TransportClientNodesService.java:245) > > > at org.elasticsearch.client.transport.TransportProxyClient.execute(TransportProxyClient.java:60) > > > at org.elasticsearch.client.transport.TransportClient.doExecute(TransportClient.java:360) > > > at org.elasticsearch.client.support.AbstractClient.execute(AbstractClient.java:405) > > > at org.elasticsearch.client.support.AbstractClient.execute(AbstractClient.java:394) > > > at com.floragunn.searchguard.tools.SearchGuardAdmin.main0(SearchGuardAdmin.java:406) > > > at com.floragunn.searchguard.tools.SearchGuardAdmin.main(SearchGuardAdmin.java:120) > > > > > > Any help would be appreciated! > > > > > > Thanks! > > > Em quinta-feira, 25 de janeiro de 2018 11:40:31 UTC-2, Jochen Kressin escreveu: > > > > > Managing internal users is described here: > > > > [http://docs.search-guard.com/latest/internal-users-database](http://docs.search-guard.com/latest/internal-users-database) > > > > > > > > The readonly / reserved flag is described here: > > > > > > > > [http://docs.search-guard.com/latest/rest-api-access-control](http://docs.search-guard.com/latest/rest-api-access-control) > > > > > > > > Agreed, the usage of the readonly / reserved flag should also be described in the Users, Roles and Permissions chapter, we will update the docs. > > > > > > > > So in your case just set the readonly flag to false for the resources that you want to make editable in the config GUI. For example, the logstash user in internal\_users.yml. > > > > > > > > What in particular are you struggling with or is unclear in the documentation? Your input helps to make the docs better. > > > > > > > > Thanks! > > > > > > On Thursday, January 25, 2018 at 9:56:27 AM UTC+1, Kernel wrote: > > > > > > > When asking questions, please provide the following information: > > > > > - Search Guard and Elasticsearch version: 6.1 > > > > > - Installed and used enterprise modules, if any : No > > > > > - JVM version and operating system version: > > > > > Java: > > > > > openjdk version “1.8.0\_151” > > > > > OpenJDK Runtime Environment (build 1.8.0\_151-b12) > > > > > OpenJDK 64-Bit Server VM (build 25.151-b12, mixed mode) > > > > > Distro: > > > > > CentOS Linux release 7.4.1708 (Core) > > > > > - Search Guard configuration files: Modified hash /sgconfig/ files > > > > > - Elasticsearch log messages on debug level > > > > > - Other installed Elasticsearch or Kibana plugins, if any : No > > > > > > > > > > Can you please make a tutorial into documentation step by step HOW to add new users and roles to it without errors? > > > > > > > > > > For example, i changed the hash for the demo users and applied with sgadmin, that it works but when i want to change the password from SG Tenant web ui for the user logstash i can’t the submit button is faded, so I tried to put readonly: false at roles and internal\_users. yml > > > > > > > > > > sg\_all\_access: > > > > > readonly: false > > > > > > > > > > > > > > > but without any luck, i still can’t edit the password, the button submit is still faded. > > > > > > > > > > PLEASE, update the documentation to be more friendly for users who dosen’t work with ELK, step by step it will be awesome > > > > > > > > > > Thanks ---
**Author:** ![Lucas\_Mello](https://avatars.discourse-cdn.com/v4/letter/l/87869e/32.png) [@Lucas\_Mello](https://forum.search-guard.com/u/Lucas_Mello)\ **Post date:** [January 31, 2018, 9:31am UTC](https://forum.search-guard.com/t/steps-to-add-users/757/5 "2018-01-31T09:31:03Z")
Thanks for your answer, Jochen. I passed the following parameters: -nhnv and -icl (I copied from ‘init\_sg.sh’) and it worked! Thanks for your time! > **···** > > Em terça-feira, 30 de janeiro de 2018 15:27:49 UTC-2, Jochen Kressin escreveu: > > > Did you try to connect to the Docker container from your local machine, or did you actually log into the container? > > > If you want to connect from your local machine, make sure to EXPOSE the Elastic ports (default 9200 REST and 9300 transport), and also publish them to the host when executing docker run: > > > > > > [https://docs.docker.com/engine/reference/commandline/run/#options](https://docs.docker.com/engine/reference/commandline/run/#options) > > > (see the --publish option) > > > > > > For example to bind 9300 from the container to 9300 on your local machine you would use: > > > > > > -p 9300:9300 > > > > On Tuesday, January 30, 2018 at 5:58:56 PM UTC+1, Lucas Mello wrote: > > > > > Hey @Jochen Kressin > > > > When I add the users to sg\_internal\_users.yml, what should I do? I’ve tried reloading the sg\_admin, but it says my Elastic Search is not running (I’m using the docker version with Search Guard). > > > > > > > > Will connect to localhost:9300 … done > > > > ERR: Cannot connect to Elasticsearch. Please refer to elasticsearch logfile for more information > > > > Trace: > > > > NoNodeAvailableException[None of the configured nodes are available: [{#transport#-1}{V1h9M4nbR9SI9wFGit9vGA}{localhost}{127.0.0.1:9300}]] > > > > at org.elasticsearch.client.transport.TransportClientNodesService.ensureNodesAreAvailable(TransportClientNodesService.java:347) > > > > at org.elasticsearch.client.transport.TransportClientNodesService.execute(TransportClientNodesService.java:245) > > > > at org.elasticsearch.client.transport.TransportProxyClient.execute(TransportProxyClient.java:60) > > > > at org.elasticsearch.client.transport.TransportClient.doExecute(TransportClient.java:360) > > > > at org.elasticsearch.client.support.AbstractClient.execute(AbstractClient.java:405) > > > > at org.elasticsearch.client.support.AbstractClient.execute(AbstractClient.java:394) > > > > at com.floragunn.searchguard.tools.SearchGuardAdmin.main0(SearchGuardAdmin.java:406) > > > > at com.floragunn.searchguard.tools.SearchGuardAdmin.main(SearchGuardAdmin.java:120) > > > > > > > > Any help would be appreciated! > > > > > > > > Thanks! > > > > Em quinta-feira, 25 de janeiro de 2018 11:40:31 UTC-2, Jochen Kressin escreveu: > > > > > > > Managing internal users is described here: > > > > > [http://docs.search-guard.com/latest/internal-users-database](http://docs.search-guard.com/latest/internal-users-database) > > > > > > > > > > The readonly / reserved flag is described here: > > > > > > > > > > [http://docs.search-guard.com/latest/rest-api-access-control](http://docs.search-guard.com/latest/rest-api-access-control) > > > > > > > > > > Agreed, the usage of the readonly / reserved flag should also be described in the Users, Roles and Permissions chapter, we will update the docs. > > > > > > > > > > So in your case just set the readonly flag to false for the resources that you want to make editable in the config GUI. For example, the logstash user in internal\_users.yml. > > > > > > > > > > What in particular are you struggling with or is unclear in the documentation? Your input helps to make the docs better. > > > > > > > > > > Thanks! > > > > > > > > On Thursday, January 25, 2018 at 9:56:27 AM UTC+1, Kernel wrote: > > > > > > > > > When asking questions, please provide the following information: > > > > > > - Search Guard and Elasticsearch version: 6.1 > > > > > > - Installed and used enterprise modules, if any : No > > > > > > - JVM version and operating system version: > > > > > > Java: > > > > > > openjdk version “1.8.0\_151” > > > > > > OpenJDK Runtime Environment (build 1.8.0\_151-b12) > > > > > > OpenJDK 64-Bit Server VM (build 25.151-b12, mixed mode) > > > > > > Distro: > > > > > > CentOS Linux release 7.4.1708 (Core) > > > > > > - Search Guard configuration files: Modified hash /sgconfig/ files > > > > > > - Elasticsearch log messages on debug level > > > > > > - Other installed Elasticsearch or Kibana plugins, if any : No > > > > > > > > > > > > Can you please make a tutorial into documentation step by step HOW to add new users and roles to it without errors? > > > > > > > > > > > > For example, i changed the hash for the demo users and applied with sgadmin, that it works but when i want to change the password from SG Tenant web ui for the user logstash i can’t the submit button is faded, so I tried to put readonly: false at roles and internal\_users. yml > > > > > > > > > > > > sg\_all\_access: > > > > > > readonly: false > > > > > > > > > > > > > > > > > > but without any luck, i still can’t edit the password, the button submit is still faded. > > > > > > > > > > > > PLEASE, update the documentation to be more friendly for users who dosen’t work with ELK, step by step it will be awesome > > > > > > > > > > > > Thanks