# Changing admin password in internal\_users has no effect

**URL:** <https://forum.opensearch.org/t/changing-admin-password-in-internal-users-has-no-effect/4451>\
**Category:** Security\
**Created:** [December 21, 2020, 9:51am UTC](https://forum.opensearch.org/t/changing-admin-password-in-internal-users-has-no-effect/4451 "2020-12-21T09:51:09Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![neographikal](https://avatars.discourse-cdn.com/v4/letter/n/0ea827/32.png) [@neographikal](https://forum.opensearch.org/u/neographikal)\
**Post date:** [December 21, 2020, 9:51am UTC](https://forum.opensearch.org/t/changing-admin-password-in-internal-users-has-no-effect/4451/1 "2020-12-21T09:51:09Z")

</div>

I’m using odfe 1.12, I ran with the default configuration, copied that over from the docker container to the local file system and mounted the directories at the correct places for the docker container:

`docker run -d --name odfe-elasticsearch --network custombridge -p 9200:9200 -p 9600:9600 -e "discovery.type=single-node" -e DISABLE_INSTALL_DEMO_CONFIG=true -v /opt/odfe-elasticsearch/config:/usr/share/elasticsearch/config/ -v /opt/odfe-elasticsearch/securityconfig/:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/ -v /etc/localtime:/etc/localtime:ro -v /opt/odfe-elasticsearch/data:/usr/share/elasticsearch/data --restart always amazon/opendistro-for-elasticsearch:latest`

Password test, hash: $2y$12$pQr3HmQ0HI8hmYJy017GXOR0JHDuMIlU7LRWOxtFe0jdqQBxjRveq

Used the hash tool to generate a hash, saved it in the file and validated by entering the running docker container:  
`docker exec -it odfe-elasticsearch /bin/bash`  
[root@a0af00b42b19 securityconfig]# ls -al  
total 68  
drwxrwxrwx 2 elasticsearch root 4096 Dec 21 10:37 .  
drwxrwxr-x 1 elasticsearch root 4096 Dec 14 22:47 …  
-rwxrwxrwx 1 elasticsearch root 49 Dec 14 22:47 action\_groups.yml  
-rwxrwxrwx 1 elasticsearch root 2541 Dec 14 22:47 audit.yml  
-rwxrwxrwx 1 elasticsearch root 9956 Dec 14 22:47 config.yml  
-rwxrwxrwx 1 elasticsearch root 12057 Dec 14 22:47 elasticsearch.yml.example  
-rwxrwxrwx 1 elasticsearch root 1319 Dec 21 10:46 internal\_users.yml  
-rwxrwxrwx 1 elasticsearch root 154 Dec 14 22:47 nodes\_dn.yml  
-rwxrwxrwx 1 elasticsearch root 3198 Dec 14 22:47 roles.yml  
-rwxrwxrwx 1 elasticsearch root 856 Dec 14 22:47 roles\_mapping.yml  
-rwxrwxrwx 1 elasticsearch root 170 Dec 14 22:47 tenants.yml  
-rwxrwxrwx 1 elasticsearch root 1982 Dec 14 22:47 whitelist.yml  
[root@a0af00b42b19 securityconfig]# cat internal\_users.yml  
—  
# This is the internal user database  
# The hash value is a bcrypt hash and can be generated with plugin/tools/hash.sh

```
_meta:
  type: "internalusers"
  config_version: 2

# Define your internal users here

## Demo users

admin:
  hash: "$2y$12$pQr3HmQ0HI8hmYJy017GXOR0JHDuMIlU7LRWOxtFe0jdqQBxjRveq"
  reserved: true
  backend_roles:
  - "admin"
  description: "Demo admin user"

kibanaserver:
  hash: "$2y$12$pQr3HmQ0HI8hmYJy017GXOR0JHDuMIlU7LRWOxtFe0jdqQBxjRveq"
  reserved: true
  description: "Demo kibanaserver user"

```

`root@neo-server:/opt/odfe-elasticsearch# docker restart odfe-elasticsearch`

Result:

```
root@neo-server:/opt/odfe-elasticsearch# curl -XGET https://localhost:9200 -u 'admin:test' --insecure
Unauthorized
root@neo-server:/opt/odfe-elasurl -XGET https://localhost:9200 -u 'admin:admin' --insecure
{
  "name" : "a0af00b42b19",
  "cluster_name" : "docker-cluster",
  "cluster_uuid" : "KFQfY5jpR0m8-it_qoIS0w",
  "version" : {
    "number" : "7.10.0",
    "build_flavor" : "oss",
    "build_type" : "tar",
    "build_hash" : "51e9d6f22758d0374a0f3f5c6e8f3a7997850f96",
    "build_date" : "2020-11-09T21:30:33.964949Z",
    "build_snapshot" : false,
    "lucene_version" : "8.7.0",
    "minimum_wire_compatibility_version" : "6.8.0",
    "minimum_index_compatibility_version" : "6.0.0-beta1"
  },
  "tagline" : "You Know, for Search"
}

```

I’m confused, why doesn’t pick up the new settings?

edit: even deleting the admin user has no effect. When entering the docker container I can see the admin entry is gone, but still it persists in Kibana and can be used to execute http calls…

---

<div class="post-metadata">

**Author:** ![neographikal](https://avatars.discourse-cdn.com/v4/letter/n/0ea827/32.png) [@neographikal](https://forum.opensearch.org/u/neographikal)\
**Post date:** [December 21, 2020, 10:44am UTC](https://forum.opensearch.org/t/changing-admin-password-in-internal-users-has-no-effect/4451/2 "2020-12-21T10:44:10Z")

</div>

You need to run

sh securityadmin.sh -cd …/securityconfig/ -icl -nhnv -cacert …/…/…/config/root-ca.pem -cert …/…/…/config/kirk.pem -key …/…/…/config/kirk-key.pem

after changing the password.

---

<div class="post-metadata">

**Author:** ![andreab](https://avatars.discourse-cdn.com/v4/letter/a/4af34b/32.png) [@andreab](https://forum.opensearch.org/u/andreab)\
**Post date:** [February 12, 2021, 5:49pm UTC](https://forum.opensearch.org/t/changing-admin-password-in-internal-users-has-no-effect/4451/3 "2021-02-12T17:49:09Z")

</div>

a tiny bit convoluted but it worked! 🙂

Thanks @neographikal

I’m running in K8s and the exact procedure was:

```auto
kubectl -n opendistro exec -it opendistro-es-master-2 -- bash
cd /usr/share/elasticsearch/plugins/opendistro_security/tools/
sh /usr/share/elasticsearch/plugins/opendistro_security/tools/securityadmin.sh -cd ../securityconfig/ -icl -nhnv -cacert ../../../config/root-ca.pem -cert ../../../config/kirk.pem -key ../../../config/kirk-key.pem

```