How to create a Kibana keystore

Creating a Kibana keystore gives the Kibana service a local secure-settings file for passwords, service account tokens, encryption keys, and other sensitive settings that should not stay in plain text inside /etc/kibana/kibana.yml.

The kibana-keystore tool writes kibana.keystore into the configuration directory selected by KBN_PATH_CONF. Current DEB and RPM package installs use /etc/kibana by default, while archive installs use the config directory inside the Kibana home tree unless that variable is changed.

For package-layout hosts, create the file in the same directory used by the running kibana.service unit, then make the kibana service account the owner before any secrets are added. Use only real Kibana setting names later, because unsupported keys in the keystore can still prevent Kibana from starting.

1. Create the keystore in the active Kibana configuration directory.

   $ sudo env KBN_PATH_CONF=/etc/kibana /usr/share/kibana/bin/kibana-keystore create
   Created Kibana keystore in /etc/kibana/kibana.keystore

   Use /etc/kibana for current DEB and RPM package installs. For archive installs, replace it with the config directory under the Kibana home tree or the directory already exported as KBN_PATH_CONF. If you add --password, configure KBN_KEYSTORE_PASSPHRASE_FILE or KEYSTORE_PASSWORD before restarting Kibana so the service can unlock the file non-interactively.
   Related: How to manage the Kibana service with systemctl in Linux

2. Set the keystore owner to the kibana service account.

   $ sudo chown kibana:kibana /etc/kibana/kibana.keystore

   Elastic's secure-settings guidance says to run keystore commands as the same user that runs Kibana. Fixing ownership after a package-layout sudo create prevents later add, remove, and list commands from failing on a root-owned file.

3. Restrict the keystore file to the service account.

   $ sudo chmod 600 /etc/kibana/kibana.keystore

   The keystore will later hold secrets. Keeping the file readable only by kibana and root avoids exposing it through broad local file permissions.

4. Verify the keystore path, owner, and mode.

   $ sudo ls -l /etc/kibana/kibana.keystore
   -rw------- 1 kibana kibana 130 Jun 18 13:51 /etc/kibana/kibana.keystore

   The file must sit beside the kibana.yml used by the running instance. If the path points to another KBN_PATH_CONF directory, create the keystore again in the active configuration directory.

5. Confirm that the kibana service account can open the empty keystore.

   $ sudo -u kibana env KBN_PATH_CONF=/etc/kibana /usr/share/kibana/bin/kibana-keystore list

   A new keystore prints no setting names yet. No output from list means the file exists, parses, and is readable by the service user.

   Related: How to add a secret to a Kibana keystore