failed to authenticate user [elastic]

Question

I had ELK stack wroking perfectly before adding the two lignes to elacticsearch.yml:

http.cors.allow-methods: OPTIONS, HEAD, GET, POST, PUT, DELETE
http.cors.allow-headers: kbn-version, Origin, X-Requested-With, Content-Type, Accept, Engaged-Auth-Token

After restarting elastic and kibana i got the below error message to both user Kibana and elastic:

[INFO ][o.e.x.s.a.AuthenticationService] [myserver] Authentication of [kibana] was terminated by realm [reserved] - failed to authenticate user [kibana]

the problem still occurs same after deleted the added lignes to the elasticsearch.yml

my initial elasticsearch.yml:

path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch

# Set the bind address to a specific IP (IPv4 or IPv6):
#@ IP
network.host: 10.xx.xx.xx
http.port: 9200
xpack.security.enabled: true
xpack.watcher.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: /etc/elasticsearch/elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: /etc/elasticsearch/elastic-certificates.p12

repositories.url.allowed_urls: "http://10.xx.xx.xx/home/User"
http.cors.enabled: true
http.cors.allow-origin: "*"

i saw some forums speaking about losing the .security index (when restarting elastic)

below is the elastic state using curl request:

[root@myserver elasticsearch]# curl -XGET 'http://10.x.x.x:9200/_cluster/state?pretty'
{
  "error" : {
    "root_cause" : [
      {
        "type" : "security_exception",
        "reason" : "missing authentication credentials for REST request [/_cluster/state?pretty]",
        "header" : {
          "WWW-Authenticate" : "Basic realm=\"security\" charset=\"UTF-8\""
        }
      }
    ],
    "type" : "security_exception",
    "reason" : "missing authentication credentials for REST request [/_cluster/state?pretty]",
    "header" : {
      "WWW-Authenticate" : "Basic realm=\"security\" charset=\"UTF-8\""
    }
  },
  "status" : 401
}

Have you please an idea about this issue? thanks in advance

Answer 1

I suspect you have other issues, but to get a response with curl when xpack.security is enabled, you also have to pass authentication details like this:

curl -XGET --user elastic:changeme 'http://10.x.x.x:9200/_cluster/state?pretty'