---
title: elastic-cloud-enterprise.sh set-install-password command
description: NAME bash elastic-cloud-enterprise.sh set-install-password — Set, rotate, or remove the install password SYNOPSIS REQUIRED PRIVILEGES To run this script,...
url: https://docs-v3-preview.elastic.dev/elastic/cloud/tree/master/reference/cloud-enterprise/ece-installation-script-set-install-password
products:
  - Elastic Cloud Enterprise
applies_to:
  - Elastic Cloud Enterprise: Planned
---

# elastic-cloud-enterprise.sh set-install-password command
**NAME**
bash elastic-cloud-enterprise.sh set-install-password — Set, rotate, or remove the install password
**SYNOPSIS**
```sh
bash elastic-cloud-enterprise.sh set-install-password
[--pwd NEW_PASSWORD | --generate | --unset]
[--zookeeper-auth ROOT_AUTH] [--secrets PATH_TO_SECRETS_FILE]
[--host-docker-host "PATH_NAME/docker.sock"] [--host-storage-path PATH_NAME]
[--podman] [[--]help]
```

**REQUIRED PRIVILEGES**
To run this script, a user must be part of the `docker` group. The host that you run this script on must be the first host that you installed Elastic Cloud Enterprise on or a host that holds the director role, unless you pass the ZooKeeper authorization with `--zookeeper-auth`. With that parameter, the script can run on any host of the installation.
**DESCRIPTION**
Sets, rotates, or removes the install password of an Elastic Cloud Enterprise installation.
While an install password is set, the bootstrap secrets that a new host reads when it joins the installation are no longer readable without authentication, and every additional host must be installed with the same password, passed to [`elastic-cloud-enterprise.sh install`](https://docs-v3-preview.elastic.dev/elastic/cloud/tree/master/reference/cloud-enterprise/ece-installation-script) with `--install-password`. Keep the password in a safe place, whether you choose it or let the command generate it. An installation without an install password does not restrict access to the bootstrap secrets, and hosts can join without providing a password.
The password itself is never written to disk or to ZooKeeper. Only a digest of it is kept on the permissions of the bootstrap secrets node. The current install password is therefore not needed to rotate or remove the password, and a lost password can always be replaced with this command.
Exactly one of `--pwd`, `--generate`, or `--unset` must be given. The command never acts on a default: a bare invocation stops with an error and changes nothing.
<important>
  Set a password only after every host of the installation runs a version of Elastic Cloud Enterprise that supports the install password. The services-forwarder on an older host loses access to the bootstrap secrets when it restarts. If that happens, remove the password with `--unset`.
</important>

**PARAMETERS**
<definitions>
  <definition term="--pwd NEW_PASSWORD">
    Sets the given install password.
  </definition>
  <definition term="--generate">
    Sets a newly generated install password and prints it.
  </definition>
  <definition term="--unset">
    Removes the install password. The bootstrap secrets become readable without authentication again, and hosts can be added without `--install-password`.
  </definition>
  <definition term="--zookeeper-auth ROOT_AUTH">
    Specifies the ZooKeeper root authorization to use. With it, the command can run on any host of the installation. The value is the `FOUND_ZK_READWRITE` environment variable of the director container, which you can read on a coordinator host with `docker exec frc-directors-director bash -c 'echo $FOUND_ZK_READWRITE'`. Cannot be combined with `--secrets`.
  </definition>
  <definition term="--secrets PATH_TO_SECRETS_FILE">
    Specifies a path to a file with secrets, used to access ZooKeeper. The file is not modified. If not specified, the script uses `HOST_STORAGE_PATH/bootstrap-state/bootstrap-secrets.json` when that file exists, where `HOST_STORAGE_PATH` is the host storage path used by the Elastic Cloud Enterprise installation, and otherwise reads the credential from the director container on this host. Cannot be combined with `--zookeeper-auth`.
  </definition>
  <definition term="--host-docker-host /PATH_NAME/docker.sock">
    Specifies the location of the Docker socket used to communicate with the Docker daemon. Defaults to `/var/run/docker.sock`.
  </definition>
  <definition term="--host-storage-path PATH_NAME">
    Specifies the host storage path used by the Elastic Cloud Enterprise installation. Defaults to `/mnt/data/elastic`. Used for determining the default locations of the secrets file and log files.
    <warning>
      This path cannot be the exact XFS volume mount point. It must be a subdirectory of the mount point. By default, the XFS volume should be mounted at `/mnt/data`.
    </warning>
  </definition>
  <definition term="--podman">
    Uses Podman as the container engine instead of Docker.
  </definition>
</definitions>


## Examples

Set the install password of the installation. From now on, every additional host must be installed with `--install-password NEW_PASSWORD`:
```
bash elastic-cloud-enterprise.sh set-install-password --pwd NEW_PASSWORD
```

Set a generated install password. The command prints the password it set:
```
bash elastic-cloud-enterprise.sh set-install-password --generate
```

Rotate the install password from a host that holds neither the first host nor a director role, using the ZooKeeper authorization read from the director container of a coordinator host:
```
bash elastic-cloud-enterprise.sh set-install-password --pwd NEW_PASSWORD --zookeeper-auth root:ROOT_PASSWORD
```

Remove the install password, so that hosts can be added without `--install-password` again:
```
bash elastic-cloud-enterprise.sh set-install-password --unset
```

Add a host to an installation that has an install password:
```
bash elastic-cloud-enterprise.sh install --coordinator-host 192.168.50.10 --roles-token 'TOKEN' --install-password NEW_PASSWORD
```