# Authentication ELK Dashboard

**URL:** <https://discuss.elastic.co/t/authentication-elk-dashboard/174308>\
**Category:** Kibana\
**Tags:** elastic-stack-security\
**Created:** [March 28, 2019, 10:33am UTC](https://discuss.elastic.co/t/authentication-elk-dashboard/174308 "2019-03-28T10:33:50Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Yashwant\_Shettigar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yashwant_shettigar/32/47652_2.png) [@Yashwant\_Shettigar](https://discuss.elastic.co/u/Yashwant_Shettigar)\
**Post date:** [March 28, 2019, 10:33am UTC](https://discuss.elastic.co/t/authentication-elk-dashboard/174308/1 "2019-03-28T10:33:51Z")

</div>

Hi All,

Recently installed ELK on my server. Now I needed to set up an authentication, to access the dashboard link. Upto some level I have succeeded, but not fully. Authentication works if I access the link with hostname or IP : [www.test.com](http://www.test.com/) or 10.10.10.10.

But as soon as I access the same link with port 5601, authentication does not work on it. It just loads the dashboard.  
Example : 10.10.10.10:5601 or [www.test.com:5601](http://www.test.com:5601/)

Below is the content of nginx.conf file :

user nginx;  
worker\_processes auto;  
error\_log /var/log/nginx/error.log;  
pid /run/nginx.pid;

include /usr/share/nginx/modules/\*.conf;

events {  
worker\_connections 1024;  
}

http {  
log\_format main '$remote\_addr - $remote\_user [$time\_local] "$request" '  
'$status $body\_bytes\_sent "$http\_referer" '  
'"$http\_user\_agent" "$http\_x\_forwarded\_for"';

access\_log /var/log/nginx/access.log main;

sendfile on;  
tcp\_nopush on;  
tcp\_nodelay on;  
keepalive\_timeout 65;  
types\_hash\_max\_size 2048;

include /etc/nginx/mime.types;  
default\_type application/octet-stream;

include /etc/nginx/conf.d/\*.conf;  
}

=======================

Below is the content of authentication file :

upstream app {  
server 10.10.10.10:5601;  
keepalive 64;  
}

server {  
listen 80;  
server\_name [www.test.com;](http://www.test.com%3B/)  
auth\_basic "Restricted Access";  
auth\_basic\_user\_file /etc/nginx/htpasswd.users;

location / {  
proxy\_pass [http://app;](http://app%3B/)  
}  
}

=========================

---

<div class="post-metadata">

**Author:** ![pup\_seba](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pup_seba/32/42988_2.png) [@pup\_seba](https://discuss.elastic.co/u/pup_seba)\
**Post date:** [March 28, 2019, 11:15am UTC](https://discuss.elastic.co/t/authentication-elk-dashboard/174308/2 "2019-03-28T11:15:58Z")

</div>

Hi,

I may be wrong here, but with nginx you are listening on port 80, which is the one using the "auth\_basic\_user\_file" with your credentials.

Port 5601, is 'just' kibana.

One thing you could do, is in the case you are using your nginx in the same server as your kibana, is to limit your kibana to only listen to your 127.0.0.1 address. If you are using a separate nginx server to access your kibana, you could either use another nginx in your kibana server for which you connect or just create a firewall rule that limits the access to it from the nginx.

Does this make sense to you?

---

<div class="post-metadata">

**Author:** ![Yashwant\_Shettigar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yashwant_shettigar/32/47652_2.png) [@Yashwant\_Shettigar](https://discuss.elastic.co/u/Yashwant_Shettigar)\
**Post date:** [March 28, 2019, 1:08pm UTC](https://discuss.elastic.co/t/authentication-elk-dashboard/174308/3 "2019-03-28T13:08:32Z")

</div>

Thanks for your suggestion. But, I didn't get you.  
Just to make clear, I have nginx and kibana on the same server.

---

<div class="post-metadata">

**Author:** ![pup\_seba](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pup_seba/32/42988_2.png) [@pup\_seba](https://discuss.elastic.co/u/pup_seba)\
**Post date:** [March 28, 2019, 1:11pm UTC](https://discuss.elastic.co/t/authentication-elk-dashboard/174308/4 "2019-03-28T13:11:20Z")

</div>

Ok. So it is even easier. All you need to do is to make sure you can not reach your kibana from outside, directly to port 5601 and only thru your nginx.

For this, you need to configure kibana to listen to your localhost only, and your nginx to redirect to localhost:5601. With this configuration, only way to reach port 5601, is either by localhost or going through your nginx, which will request an auth.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 25, 2019, 1:20pm UTC](https://discuss.elastic.co/t/authentication-elk-dashboard/174308/5 "2019-04-25T13:20:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.