WARNING: Version 5.2 of the Elastic Stack has passed its EOL date.
This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.
Setting Up User Authentication
editSetting Up User Authentication
editAuthentication identifies an individual. To gain access to restricted resources, a user must prove their identity, via passwords, credentials, or some other means (typically referred to as authentication tokens).
You can use the native support for managing and authenticating users, or integrate with external user management systems such as LDAP and Active Directory. For information about managing native users, see Managing Native Users.
Built-in Users
editX-Pack security provides built-in user credentials to help you get up and running.
These users have a fixed set of privileges and the default password changeme
.
Table 3. X-Pack security Built-in Users
Name |
Description |
|
A built-in superuser. |
|
The user Kibana uses to connect and communicate with Elasticsearch. |
|
The user Logstash uses when storing monitoring information in Elasticsearch. |
You must reset the default passwords for all built-in users. You can update passwords from the Management > Users UI in Kibana or with the Reset Password API:
PUT _xpack/security/user/elastic/_password { "password": "elasticpassword" }
PUT _xpack/security/user/kibana/_password { "password": "kibanapassword" }
PUT _xpack/security/user/logstash_system/_password { "password": "logstashpassword" }
Once the kibana
user password is reset, you need to update the Kibana server
with the new password by setting elasticsearch.password
in the
kibana.yml
configuration file:
elasticsearch.password: kibanapassword
The logstash_system
user is used internally within Logstash when
monitoring is enabled for logstash
If you wish to enable this feature in Logstash, then you need to update the Logstash
configuration with the new password by setting xpack.monitoring.elasticsearch.password
in
the logstash.yml
configuration file:
xpack.monitoring.elasticsearch.password: logstashpassword
If you have upgraded from an older version of elasticsearch/x-pack,
the logstash_system
user may have defaulted to disabled for security reasons.
Once the password has been changed, you can enable the user via the following API call:
PUT _xpack/security/user/logstash_system/_enable