Kibana user forbidden error {"statusCode":403,"error":"Forbidden","message":"Forbidden"} - elasticsearch

I just setup my xpack in elasticsearch 7.1.0
as below in elasticsearch.yml:
xpack.security.enabled: true
discovery.type: single-node
in my elasticsearch.yml
Then, i ran
>elasticsearch-setup-passwords interactive
and changed all my built-in user passwords.
this is the change i made in Kibana.yml
xpack.security.enabled: true
elasticsearch.username: "kibana"
elasticsearch.password: "password#123"
When i restarted Kibana,
i ws prompted with a username password page, where i gave
kibana/password#123 that i had set in my yml.
Im getting the below response:
{"statusCode":403,"error":"Forbidden","message":"Forbidden"}
Please help me out.


Resolution:
using "elastic" user account instead of kibana fixed this issue.


Configuring security in Kibana
To use Kibana with X-Pack security:
Update the following settings in the kibana.yml configuration file:
elasticsearch.username: "kibana"
elasticsearch.password: "kibanapassword"
Set the xpack.security.encryptionKey property in the kibana.yml configuration file.
xpack.security.encryptionKey: "something_at_least_32_characters"
Optional: Change the default session duration.
xpack.security.sessionTimeout: 600000
Restart Kibana.
Please follow this link using-kibana-with-security

Related

Couldn't configure Elastic Retry or update the kibana.yml file manually

I am tring to configure kibana but I get flowing error
Couldn't configure Elastic Retry or update the kibana.yml file manually.
this is my /etc/kibana/kibana.yml
# Kibana is served by a back end server. This setting specifies the port to use.
server.port: 5601
server.host: '127.0.0.1'
kibana.index: ".kibana"
elasticsearch.username: "user"
#elasticsearch.password: "pass"
xpack.encryptedSavedObjects.encryptionKey: 706c88e045c127e21b81c902425cdb54
xpack.reporting.encryptionKey: d67296d7d4958bdd1594e965e6b97ab9
xpack.security.encryptionKey: d496d7cb6a5983c213f7902767069744
xpack.encryptedSavedObjects.encryptionKey: 706c88e045c127e21b81c902425cdb54
xpack.reporting.encryptionKey: d67296d7d4958bdd1594e965e6b97ab9
xpack.security.encryptionKey: d496d7cb6a5983c213f7902767069744
how can I fix this error???
pleas help me!!!!

how to xpack security reset in elasticsearch?

I want to reset the ID and password of elasticsearch and kibana.
I tried to reset it, but an error occurred as below.
ubuntu#elk:/usr/share/elasticsearch/bin$ sudo ./elasticsearch-setup-passwords auto
error occured
Connection failure to: http://10.0.10.4:9200/_security/_authenticate?pretty failed: Connection refused
ERROR: Failed to connect to elasticsearch at http://10.0.10.4:9200/_security/_authenticate?pretty. Is the URL correct and elasticsearch running?
my elasticsearch.yml file
xpack.security.enabled: true
network.host: 0.0.0.0
http.port: 9200
discovery.type: single-node
my kibana.yml file
server.port: 5601
server.host: 0.0.0.0
elasticsearch.hosts: ["http://localhost:9200"]
elasticsearch.username: "elastic"
elasticsearch.password: "dlswp12"
#xpack.security.encryptionKey: "something_at_least_32_characters"
#xpack.security.sessionTimeout: 600000
#xpack.monitoring.enabled: false
how to xpack security(id & password) reset in elasticsearch?

Elasticsearch migration from 6.8 to 7.9. [config validation of [elasticsearch].url]: definition for this key is missing

I have the following error during the migration of our Elasticsearch instance from version 6.8 to 7.9:
FATAL Error: [config validation of [elasticsearch].url]: definition for this key is missing
The whole configuration is the same.
How to fix this error?

kibana.yml should look like this
server.host: "0.0.0.0"
elasticsearch.url: http://127.0.0.1:9200
kibana.index: ".kibana"
and also you can pass as an environment variable
SERVER_NAME: kibana
ELASTICSEARCH_URL: http://127.0.0.1:9200
Here's a link
for more kibana config options.

Enable elasticsearch.hosts in config/kibana.yml,
elasticsearch.hosts: ["http://localhost:9200/"]
That should solve your problem.

Unable to start Elasticsearch Enterprise/App Search

I've got a self-hosted Elasticsearch + Kibana environment that I'm trying to add Elasticsearch Enterprise/App Search to.
While trying to start up Elasticsearch Enterprise/App Search I'm getting the below error:
Elasticsearch API key service must be enabled. It is enabled automatically when you configure Elasticsearch to use TLS on the HTTP interface.
Alternatively, you can explicitly enable the setting within Elasticsearch by opening config/elasticsearch.yml and adding:
xpack.security.authc.api_key.enabled: true
I have added that setting and am still getting the error upon startup.
Here are the properties I modified in the elasticsearch.yml
xpac.security.enabled true
#xpack.security.audit.logfile.events.emit_request_body: true
discovery.type: single-node
xpack.security.authc.api_key.enabled: true
xpack:
security:
authc:
realms:
native:
native1:
order: 0

What is the default user and password for Elasticsearch 7.8.0?

What's is the default username and password for Elasticsearch 7.8.0? It's asking this on 9200 port. Tried these (username pass):
elastic [no pass]
elastic elastic
without entering anything
elastic changeme
elastic password
user password
OS: Windows 10 x64, installed ES with MSI installer from its website.
yml file:
bootstrap.memory_lock: false
cluster.name: elasticsearch
http.port: 9200
node.data: true
node.ingest: true
node.master: true
node.max_local_storage_nodes: 1
node.name: LAPTOP-1C4GVFSU
path.data: C:\ProgramData\Elastic\Elasticsearch\data
path.logs: C:\ProgramData\Elastic\Elasticsearch\logs
transport.tcp.port: 9300
xpack.license.self_generated.type: basic
xpack.security.enabled: true

Somehow default username password isn't working. I had to set the password on CMD by
bin/elasticsearch-setup-passwords interactive
bin/elasticsearch-setup-passwords auto
The interactive parameter prompts new password for the users, whereas auto generates them for you.

Username is elastic and Password is password
If you are trying to debug Elasticsearch Source Code, then after running ./gradlew :run, ES starts building and running.
Once the service has started, run this curl command from another window :
curl -u elastic:password localhost:9200
After which add the username and password as mentioned above. To know more about this refer CONTRIBUTING.md
It may also be possible, that you have only added the xpack.security.enabled setting to the ES_PATH_CONF/elasticsearch.yml file.
After which if you try to hit localhost:9200, then it will ask for username and password (as you have enabled security feature). But since you have not set up username and password, so it will throw security_exception (when incorrect username and password are entered).
So, for that, run bin/elasticsearch-setup-passwords interactive, and set the username and password.
Refer to this documentation for Setting built-in user and password

try the following command
bin/elasticsearch-reset-password -u elastic
it generates new password for user "elastic"

Check /etc/nginx/ for nginx.con files and nginx passwd file.
ElasticSearch is using simple Nginx passwd file and basic authentication for default instance.

Resources