Best Practice for server.ssl.key Permissions in Kibana?

[anpama]

Hi everyone,

I'm setting up SSL for Kibana (via server.ssl.key in kibana.yml) to encrypt browser traffic. My private key file has 600 permissions, and Kibana can’t read it unless I run it as root.

However, both the docs and the program warn:
“Kibana should not be run as root. Use --allow-root to continue.”

What are the best practices in this case?

• Should I loosen the key file's permissions?
• Should I use --allow-root?
• Anything else I should consider?

Thanks!

[stephenb (Stephen Brown)]

Hi @anpama

@anpama

• Should I loosen the key file's permissions? Yes, that is a common approach, you could change the owner to the kibana user to keep the restriction tight (depending on how you installed)
• Should I use --allow-root? No
• Anything else I should consider? You could protect the key with a passphrase, you could put the passphrase in the kibana keystore...