# Allow all from localhost but login required in Kibana **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [February 29, 2016, 11:33pm UTC](https://discuss.elastic.co/t/allow-all-from-localhost-but-login-required-in-kibana/43058 "2016-02-29T23:33:11Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![sqpdln](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sqpdln/32/644_2.png) [@sqpdln](https://discuss.elastic.co/u/sqpdln)\ **Post date:** [February 29, 2016, 11:33pm UTC](https://discuss.elastic.co/t/allow-all-from-localhost-but-login-required-in-kibana/43058/1 "2016-02-29T23:33:11Z")
Hi, I have a rather simple use case. I want Kibana (localhost:5601) to require login. But I also want all my api's running on localhost that integrate with Elasticsearch to be able to communicate without authentication. I've been experimenting with ip filtering and anonymous access, but can't really make it work. I'm using Kibana 4.1.2. What would be the best approach here? Thanks. ---
**Author:** ![skearns](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/skearns/32/125945_2.png) [@skearns](https://discuss.elastic.co/u/skearns)\ **Post date:** [March 1, 2016, 1:43pm UTC](https://discuss.elastic.co/t/allow-all-from-localhost-but-login-required-in-kibana/43058/2 "2016-03-01T13:43:44Z")
While that may sound like a simple use-case, the configuration you describe isn't secure - anyone who can access the box and make requests to localhost would be able to wreak havoc with your cluster. Instead, have you considered setting up an administrator account and/or using PKI (certificate-based authentication) for your administrative needs? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:46pm UTC](https://discuss.elastic.co/t/allow-all-from-localhost-but-login-required-in-kibana/43058/3 "2017-07-06T13:46:19Z")