Reverse proxy + XPACK

Elastic Stack Kibana
1

Hi,

I'm trying to setup Nginx to do reverse proxy but I'm struggling to make the X-PACK authentication work.

My infrastruture is composed by HTTPS load balancer + NGINX + Kibana.

I'm currently accessing my Kibana by IP and authenticating using X-PACK. I only want to "hide" it behing NGINX keeping all my URL under the same server.

Any Kibana URL tries to login first but ends in this error message

{ [Error] request: {}, response: {}, body: '<!doctype html><meta charset="utf-8"><meta name=viewport content="width=device-width, initial-scale=1"><title>404</title>404 Not Found', name: 'Error', req: {}, res: {} }
Version: 7.10.1
Build: 36063
Error
    at Fetch._callee3$ (https://URL_KIBANA.net/36063/bundles/core/core.entry.js:6:59535)
    at l (https://URL_KIBANA.net/36063/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:380:1740520)
    at Generator._invoke (https://URL_KIBANA.net/36063/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:380:1740273)
    at Generator.forEach.e.<computed> [as next] (https://URL_KIBANA.net/36063/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:380:1740877)
    at fetch_asyncGeneratorStep (https://URL_KIBANA.net/36063/bundles/core/core.entry.js:6:52652)
    at _next (https://URL_KIBANA.net/36063/bundles/core/core.entry.js:6:52968)

I already tried different configurations (Kibana and NGINX) with no sucess.

That is my last config:

location / {
  proxy_read_timeout 900s;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header Host $host;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header X-Forwarded-Proto http;
  proxy_redirect off;
  proxy_pass http://kibanaIPandportupstream;
}

kibana.yml

server.port: 5601
server.host: "0.0.0.0"
elasticsearch.hosts: ["http://xxx.xxx.xxx:9200"]
elasticsearch.username: "kibana_system"
elasticsearch.password: "changeme"
elasticsearch.requestHeadersWhitelist: [ es-security-runas-user, authorization ]
xpack.monitoring.elasticsearch.requestHeadersWhitelist: [ es-security-runas-user, authorization ]
2

It looks like you are not setting the server.basePath setting or any of the other settings that Kibana provides specifically for use with reverse proxies: Configure Kibana | Kibana Guide [7.12] | Elastic

I found some relevant and helpful information in this other thread: Nginx reverse proxy setup for Kibana

Here's a user who has a working config with basePath: Nginx reverse proxy with rewrite and app/kibana#/discover

1 Like
3

Thanks for replying,

In the end we decided to have a go with Elastic Cloud which made our setup way simpler and easier.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.