# Unable to change admin password

**URL:** <https://forum.search-guard.com/t/unable-to-change-admin-password/1008>\
**Category:** Search Guard\
**Created:** [July 11, 2018, 12:28pm UTC](https://forum.search-guard.com/t/unable-to-change-admin-password/1008 "2018-07-11T12:28:26Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dylan\_Osef](https://avatars.discourse-cdn.com/v4/letter/d/54ee81/32.png) [@Dylan\_Osef](https://forum.search-guard.com/u/Dylan_Osef)\
**Post date:** [July 11, 2018, 12:28pm UTC](https://forum.search-guard.com/t/unable-to-change-admin-password/1008/1 "2018-07-11T12:28:26Z")

</div>

Hello everybody,

I try to change the admin demo password with a custom password.

I removed the readonly flag of “admin” user :

{  
“readonly”: “false”,  
“roles”: [  
“admin”  
],  
“attributes”: {  
“attribute1”: “value1”,  
“attribute3”: “value3”,  
“attribute2”: “value2”  
},  
“password”: “”  
}

``

I removed the readonly flag of “sg\_all\_access” :

{  
“backendroles”: [  
“admin”  
],  
“readonly”: “false”  
}

``

and next execute the sgadmin\_demo.sh script to apply configuration changes.

But on Kibana GUI SG management, when I connect with Admin, the user is “reserved” which prevents me to change his passwd.

Have you got a solution ?

---

<div class="post-metadata">

**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\
**Post date:** [July 11, 2018, 2:06pm UTC](https://forum.search-guard.com/t/unable-to-change-admin-password/1008/2 "2018-07-11T14:06:08Z")

</div>

I do not fully understand what you posted. So you say you removed the _readonly_ flag from the admin user, but the posted configuration is in JSON format, not YAML. Where exactly did you change the readonly settings, and where are the JSON snippets from?

> **···**
>
> On Wednesday, July 11, 2018 at 2:28:26 PM UTC+2, Dylan Osef wrote:
> 
> > Hello everybody,
> 
> > 
> 
> > I try to change the admin demo password with a custom password.
> 
> > 
> 
> > I removed the readonly flag of “admin” user :
> 
> > 
> 
> > {  
> > “readonly”: “false”,  
> > “roles”: [  
> > “admin”  
> > ],  
> > “attributes”: {  
> > “attribute1”: “value1”,  
> > “attribute3”: “value3”,  
> > “attribute2”: “value2”  
> > },  
> > “password”: “”  
> > }
> 
> > ``
> 
> > 
> 
> > 
> 
> > I removed the readonly flag of “sg\_all\_access” :
> 
> > 
> 
> > {  
> > “backendroles”: [  
> > “admin”  
> > ],  
> > “readonly”: “false”  
> > }
> 
> > ``
> 
> > 
> 
> > and next execute the sgadmin\_demo.sh script to apply configuration changes.
> > 
> > But on Kibana GUI SG management, when I connect with Admin, the user is “reserved” which prevents me to change his passwd.
> > 
> > Have you got a solution ?

---

<div class="post-metadata">

**Author:** ![Dylan\_Osef](https://avatars.discourse-cdn.com/v4/letter/d/54ee81/32.png) [@Dylan\_Osef](https://forum.search-guard.com/u/Dylan_Osef)\
**Post date:** [July 11, 2018, 2:19pm UTC](https://forum.search-guard.com/t/unable-to-change-admin-password/1008/3 "2018-07-11T14:19:59Z")

</div>

Hello Jochen,

I changed the readonly flag directly in /sgpath/plugin/tools/sg\_internal\_users.yml, now it looks like :

[root@lpsrvelkifr1 sgconfig]# cat sg\_internal\_users.yml

# This is the internal user database

# The hash value is a bcrypt hash and can be generated with plugin/tools/hash.sh

#password is: admin  
admin:  
readonly: false  
hash: $2a$12$VcCDgh2NDk07JGN0rjGbM.Ad41qVR/YFJcgHp0UGns5JDymv..TOG  
roles:  
- admin  
attributes:  
#no dots allowed in attribute names  
attribute1: value1  
attribute2: value2  
attribute3: value3

#password is: logstash  
logstash:  
hash: $2a$12$u1ShR4l4uBS3Uv59Pa2y5.1uQuZBrZtmNfqB3iM/.jL0XoV9sghS2  
roles:  
- logstash

#password is: kibanaserver  
kibanaserver:  
readonly: true  
hash: $2a$12$4AcgAt3xwOWadA5s5blL6ev39OXDNhmOesEoo33eZtrq2N0YrU3H.

#password is: kibanaro  
kibanaro:  
hash: $2a$12$JJSXNfTowz7Uu5ttXfeYpeYE0arACvcwlPBStB1F.MI7f0U9Z4DGC  
roles:  
- kibanauser  
- readall

#password is: readall  
readall:  
hash: $2a$12$ae4ycwzwvLtZxwZ82RmiEunBbIPiAmGZduBAjKN0TXdwQFtCwARz2  
#password is: readall  
roles:  
- readall

#password is: snapshotrestore  
snapshotrestore:  
hash: $2y$12$DpwmetHKwgYnorbgdvORCenv4NAK8cPUg8AI6pxLCuWf/ALc0.v7W  
roles:  
- snapshotrestore

``

And the JSON code is a copy/paste from “\</\> Show JSON” on user admin in Kibana SG GUI plugin

Can I juste change the hash to change the pass ?

Thx you

---

<div class="post-metadata">

**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\
**Post date:** [July 11, 2018, 3:49pm UTC](https://forum.search-guard.com/t/unable-to-change-admin-password/1008/4 "2018-07-11T15:49:27Z")

</div>

Yes you can, but the removing the readonly flag here should make it possible to change the user in the configuration GUI.

Please use the hash.sh script in the tools directory to create the password hashes:

[https://docs.search-guard.com/latest/internal-users-database#generating-hashed-passwords](https://docs.search-guard.com/latest/internal-users-database#generating-hashed-passwords)

> **···**
>
> On Wednesday, July 11, 2018 at 4:19:59 PM UTC+2, Dylan Osef wrote:
> 
> > Hello Jochen,
> 
> > 
> 
> > I changed the readonly flag directly in /sgpath/plugin/tools/sg\_internal\_users.yml, now it looks like :
> 
> > 
> 
> > [root@lpsrvelkifr1 sgconfig]# cat sg\_internal\_users.yml
> > 
> > # This is the internal user database
> > 
> > # The hash value is a bcrypt hash and can be generated with plugin/tools/hash.sh
> > 
> > #password is: admin  
> > admin:  
> > readonly: false  
> > hash: $2a$12$VcCDgh2NDk07JGN0rjGbM.Ad41qVR/YFJcgHp0UGns5JDymv…TOG  
> > roles:  
> > - admin  
> > attributes:  
> > #no dots allowed in attribute names  
> > attribute1: value1  
> > attribute2: value2  
> > attribute3: value3
> > 
> > #password is: logstash  
> > logstash:  
> > hash: $2a$12$u1ShR4l4uBS3Uv59Pa2y5.1uQuZBrZtmNfqB3iM/.jL0XoV9sghS2  
> > roles:  
> > - logstash
> > 
> > #password is: kibanaserver  
> > kibanaserver:  
> > readonly: true  
> > hash: $2a$12$4AcgAt3xwOWadA5s5blL6ev39OXDNhmOesEoo33eZtrq2N0YrU3H.
> > 
> > #password is: kibanaro  
> > kibanaro:  
> > hash: $2a$12$JJSXNfTowz7Uu5ttXfeYpeYE0arACvcwlPBStB1F.MI7f0U9Z4DGC  
> > roles:  
> > - kibanauser  
> > - readall
> > 
> > #password is: readall  
> > readall:  
> > hash: $2a$12$ae4ycwzwvLtZxwZ82RmiEunBbIPiAmGZduBAjKN0TXdwQFtCwARz2  
> > #password is: readall  
> > roles:  
> > - readall
> > 
> > #password is: snapshotrestore  
> > snapshotrestore:  
> > hash: $2y$12$DpwmetHKwgYnorbgdvORCenv4NAK8cPUg8AI6pxLCuWf/ALc0.v7W  
> > roles:  
> > - snapshotrestore
> 
> > ``
> 
> > And the JSON code is a copy/paste from “\</\> Show JSON” on user admin in Kibana SG GUI plugin
> 
> > 
> 
> > Can I juste change the hash to change the pass ?
> 
> > 
> 
> > Thx you

---

<div class="post-metadata">

**Author:** ![Dylan\_Osef](https://avatars.discourse-cdn.com/v4/letter/d/54ee81/32.png) [@Dylan\_Osef](https://forum.search-guard.com/u/Dylan_Osef)\
**Post date:** [July 12, 2018, 6:08am UTC](https://forum.search-guard.com/t/unable-to-change-admin-password/1008/5 "2018-07-12T06:08:29Z")

</div>

In the user GUI configuration my “admin” user is seen has “reserved” so i’m unable to change anything…

That’s why I would like to know if i replace the current hash in the sg\_internal\_users.yml it could work ?

Thank you.

---

<div class="post-metadata">

**Author:** ![Dylan\_Osef](https://avatars.discourse-cdn.com/v4/letter/d/54ee81/32.png) [@Dylan\_Osef](https://forum.search-guard.com/u/Dylan_Osef)\
**Post date:** [July 12, 2018, 10:00am UTC](https://forum.search-guard.com/t/unable-to-change-admin-password/1008/6 "2018-07-12T10:00:42Z")

</div>

I changed the admin hash into sg\_internal\_users.yml and it works 🙂

Thx for help Jochen