# Securing Kibana + Elasticsearch for public use **URL:** \ **Category:** Elasticsearch\ **Created:** [March 6, 2014, 6:50am UTC](https://discuss.elastic.co/t/securing-kibana-elasticsearch-for-public-use/16182 "2014-03-06T06:50:23Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![queue](https://avatars.discourse-cdn.com/v4/letter/q/848f3c/32.png) [@queue](https://discuss.elastic.co/u/queue)\ **Post date:** [March 6, 2014, 6:50am UTC](https://discuss.elastic.co/t/securing-kibana-elasticsearch-for-public-use/16182/1 "2014-03-06T06:50:23Z")
Hi, I'd like to expose Kibana + Elasticsearch publicly, since it's an easy exploration tool for the data I'm storing in es. From browsing the web and the mailing list, it looks like such a setup--while discouraged--can still be done by using a reverse proxy in front of the HTTP server of es. For example, however [http://demo.kibana.org](http://demo.kibana.org) is secured. The steps I'm planning to take are: - Use nginx proxy\_pass for public HTTP - Disable PUT/DELETE methods - Disable POST on all but the \_search endpoint for my index. - Disable dynamic script execution in queries. Is there anything else I need to do to ensure users can't add/change/delete the data or gain access to the machine through es? (As an aside, does anybody have experience running elasticsearch on VPSses with 256-512MB of ram? Any tips to reduce memory usage?) -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/121f467ed631f7d1d2e10ca149172a7f%40hakase.org](https://groups.google.com/d/msgid/elasticsearch/121f467ed631f7d1d2e10ca149172a7f%40hakase.org). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![otisg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/otisg/32/492_2.png) [@otisg](https://discuss.elastic.co/u/otisg)\ **Post date:** [March 12, 2014, 2:57am UTC](https://discuss.elastic.co/t/securing-kibana-elasticsearch-for-public-use/16182/2 "2014-03-12T02:57:00Z")
Hi, Re ES and VPSs with up to 512 MB RAM. Sure, doable, but very very small nodes/indexes. 🙂 ## Otis Performance Monitoring \* Log Analytics \* Search Analytics Solr & Elasticsearch Support \* [http://sematext.com/](http://sematext.com/) On Thursday, March 6, 2014 1:50:23 AM UTC-5, [qu...@hakase.org](mailto:qu...@hakase.org) wrote: > Hi, > > I'd like to expose Kibana + Elasticsearch publicly, since it's an easy > exploration tool for the data I'm storing in es. From browsing > the web and the mailing list, it looks like such a setup--while > discouraged--can still be done by using a reverse proxy in front of the > HTTP server of es. For example, however [http://demo.kibana.org](http://demo.kibana.org) is > secured. > > The steps I'm planning to take are: > > - Use nginx proxy\_pass for public HTTP > - Disable PUT/DELETE methods > - Disable POST on all but the \_search endpoint for my index. > - Disable dynamic script execution in queries. > > Is there anything else I need to do to ensure users can't > add/change/delete > the data or gain access to the machine through es? > > (As an aside, does anybody have experience running elasticsearch on > VPSses > with 256-512MB of ram? Any tips to reduce memory usage?) -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/fbbad28f-7830-4737-9f02-fee022f11d96%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/fbbad28f-7830-4737-9f02-fee022f11d96%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:44am UTC](https://discuss.elastic.co/t/securing-kibana-elasticsearch-for-public-use/16182/3 "2017-07-06T01:44:02Z")
Closed on July 6, 2017, 1:44am UTC