Al Sunseri alsunseri

I ran elasticsearch-setup-passwords to add "security" to my little ELK stack. But 2 months later I could not log in, I did not write the passwords down -
and the username and password sets were not stored in the configs like i thought they were .

Instead of turning security off or starting over I found a better way to "recover" my kibana login credentials.

Once I did this I was able to log into "elastic"/Kibana and get back to searching through logs.

This is what I did as root:

	#!/usr/bin/bash
	# author - me and anthropic claude
	# Configuration
	REMOTE_HOST="[email protected]"
	REMOTE_PORT="23237" # Port on the remote server
	LOCAL_PORT="22" # Local SSH port to expose
	MONITOR_PORT="0" # AutoSSH monitoring port (0 disables it)
	AUTOSSH_PIDFILE="/tmp/reverse_tunnel_autossh.pid"
	SSH_PIDFILE="/tmp/reverse_tunnel_ssh.pid"

	# CMAKE_MINIMUM_REQUIRED(VERSION 2.8.13)
	# instructions:
	# install cmake, put it in your path for ease of use
	# Linux: sudo apt install build-essential libudev-dev cmake
	# Windows: Download and install msi from https://cmake.org/download/
	# cd into project dir
	# mkdir ./build
	# for the following steps the config in both must match - either Release or Debug
	# create build files (on Windows this makes Visual Studio projects)
	# cmake -S . -B ./build "-DCMAKE_BUILD_TYPE=Release" # or Debug, only used for command line build, IDE ignores this

	// Open your browser's developer tools --> "console" (i.e. by pressing F12 and click on console tab)
	// type or paste the following:
	Intl.DateTimeFormat().resolvedOptions().timeZone
	// Note - type "allow paste" and press the enter key if your browser disables pasting into the console.

	xmlstarlet sel -t -m "//host"\
	-v "address/@addr" -o " "\
	-m "ports/port[state/@state='open']"\
	-v "@portid" -o "/" -v "state/@state"\
	-n many-up-hosts-nmap-scan-results.xml

	Fix apt warnings about keys "stored in legacy trusted.gpg keyring"
	Add a key to /etc/apt/trusted.gpg.d/
	For instance with sysdig , the key is in ascii armored format and available at https://download.sysdig.com/
	this simple command will immediately get apt to stop complaining:

	wget -qO- https://download.sysdig.com/DRAIOS-GPG-KEY.public \| sudo tee /etc/apt/trusted.gpg.d/sysdig.asc

	If the file is in "GPG key public ring" binary OpenPGP format then use .gpg extension.

	Also See note in apt-key(8) :

	#!/usr/bin/bash
	# on amazon linux II my developers can not run sudo and more importantly no user has a password.
	# installing linuxbrew/homebrew is a pain unless you do this:
	# as root ( or sudo from the admin user )
	mkdir -p /home/linuxbrew/
	chown $THE_DEV_USERNAME: /home/linuxbrew/
	#### root/admin work is done !!!!
	# then the developer themselves can run the rest:
	#
	# as THE_DEV_USERNAME person

	#!/bin/sh

	# if your TERM is not set to *-256color or the like then run this:
	# export TERM=xterm-256color

	i=0
	while [ $i -ne 255 ]
	do
	i=$(($i+1))
	tput setaf $i && echo -n "setaf $i in color tags "

	# have the date and time in the prompt as well as username@host and current directory
	# the time display is extremely useful - for instance when an ssh session dies , etc
	# my values are for DARK backgrounds!!!
	# to test the various color values on YOUR termial you can do something like

	# i=0 ; while [ $i -ne 255 ]; do i=$(($i+1)); tput setaf $i && echo -n "setaf $i in ncurses "; tput setaf $i \| xxd; done
	# i.e. loop thru these 2 commands for 0-255
	tput setaf $i && echo -n "setaf $i in ncurses "
	tput setaf $i \| xxd
	################################################################################

	The delete command will remove the cert from the server along with the assoicated letsencrypt files for that certificate.

	# certbot delete --cert-name certtoremove.tld
	OR
	just run

	# certbot delete

	Running certbot delete with no options leads to a nice numbered list of all certificates .
	Choose the certs to be removed by number ( comma or space separated ) but note - blank answer will remove all certs supposedly so be careful.