1

I have a 7.6.2 cluster of three nodes and want to apply the x-pack security. So I've updated my elasticsearch.yml conf. I first want to set password

/usr/share/elasticsearch/bin/elasticsearch-setup-passwords auto

Unexpected response code [405] from calling GET http://xxx:9200/_security/_authenticate?pretty
It doesn't look like the X-Pack security feature is enabled on this Elasticsearch node.
Please check if you have enabled X-Pack security in your elasticsearch.yml configuration file.

ERROR: X-Pack Security is disabled by configuration.

But it fails, so I restart one elasticsearch node, but then still impossible to set password

/etc/elasticsearch$ /usr/share/elasticsearch/bin/elasticsearch-setup-passwords auto

Your cluster health is currently RED.
This means that some cluster data is unavailable and your cluster is not fully functional.

It is recommended that you resolve the issues with your cluster before running elasticsearch-setup-passwords.
It is very likely that the password changes will fail when run against an unhealthy cluster.

Do you want to continue with the password setup process [y/N]y

Initiating the setup of passwords for reserved users elastic,apm_system,kibana,logstash_system,beats_system,remote_monitoring_user.
The passwords will be randomly generated and printed to the console.
Please confirm that you would like to continue [y/N]y



Connection failure to: http://xxx:9200/_security/user/apm_system/_password?pretty failed: Read timed out

ERROR:Failed to set password for user [apm_system].

And I'm not able to access anything as I have authentication issue. I can't find how to apply security successfully on my cluster. Unable to set password or unable to authenticate ?

glmrenard
  • 675
  • 1
  • 8
  • 16

3 Answers3

2

You need to set xpack.security.enabled: true for all nodes in the cluster and then do a full cluster restart (all nodes). After that you can generate passwords using 

/usr/share/elasticsearch/bin/elasticsearch-setup-passwords auto
cpleafs
  • 31
  • 2
  • Thanks, you mean i start one node, then the second, then the third with disabling shard allocation during the restart ? And once all my cluster have restarted, I can then run the setup-password command. So I can't access my node (any GET access) while the full reboot AND password command ? – glmrenard May 20 '20 at 10:29
  • 1
    You can do a rolling restart. This means that you restart first node, wait for the cluster to get to GREEN and then restart the second. Wait for GREEN again and then restart the third one. But after enabling passwords, your clients will not be able to connect unauthenticated. – cpleafs May 20 '20 at 11:03
0

i have the same issue. after upgrade .

  1. i set "xpack.security.enabled= true " and trying to start but could not and it throws transport ssl to be enabled.
  2. set both xpack.security.transport.ssl.enabled: true & xpack.security.enabled= true tried setup passwords as per basic security. a. but got " fail to setup password on [apm_system] b. while trying _cat/health , got "missing credentials"
vijay kaali
  • 1
  • 1
    if you want you can try to format your answer in markdown so it looks neater and have a consistent style (you are showing setting a variable both with var: val and var=val syntaxes) – ramrunner Jan 18 '22 at 07:05
0

Your cluster does not have a data node. 

Just add to the /etc/elasticsearch/elasticsearch.yml

node.data: true

and it will work.

Markus07
  • 1
  • 1