# パスワード変更の禁止 **URL:** \ **Category:** Kibana\ **Tags:** elastic-stack-security\ **Created:** [February 13, 2021, 11:05am UTC](https://discuss.elastic.co/t/topic/264210 "2021-02-13T11:05:49Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![syogo](https://avatars.discourse-cdn.com/v4/letter/s/50afbb/32.png) [@syogo](https://discuss.elastic.co/u/syogo)\ **Post date:** [February 13, 2021, 11:05am UTC](https://discuss.elastic.co/t/topic/264210/1 "2021-02-13T11:05:49Z")
[kibana\_dashboard\_only\_user]を持っているAというアカウントでログインしたとき，図のAccountSettingsページに移動させないためにはどうしたらいいですか？最終的にパスワード変更ができないようにしたいです．また，リバースプロキシでNGINXを使用しています．versinは6.8.13であり，ライセンスはBasicです． ![A](https://us1.discourse-cdn.com/elastic/original/3X/b/9/b931fa53cd0f841729f5a919e92f64fcd4d4c316.png) ---
**Author:** ![nickofthyme](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nickofthyme/32/60032_2.png) [@nickofthyme](https://discuss.elastic.co/u/nickofthyme)\ **Post date:** [March 5, 2021, 7:46pm UTC](https://discuss.elastic.co/t/topic/264210/2 "2021-03-05T19:46:02Z")
> [Translated] How can I prevent the user from going to the Account Settings page in the figure when logging in with an account named A that has [kibana\_dashboard\_only\_user]? Finally, I want to prevent the password from being changed. Also, NGINX is used as a reverse proxy. version is 6.8.13 and the license is Basic. The short answer is no. I tried a few hacks to see if I could do what you are asking for but in the end, I found no solution. This functionality is by design and admins are not meant to forbid access to a user changing their own password. User password hashes are stored in the `.security*` indices which are used by the security module to provide security features for ES (see [discussion](https://discuss.elastic.co/t/what-does-restricted-indices-means-in-security-has-privileges-api/185175/2)). Non-super users are not granted access to restricted indices unless the [`allow_restricted_indices`](https://www.elastic.co/guide/en/elasticsearch/reference/current/defining-roles.html#CO530-5) flag is set to true on the [Indices Privileges](https://www.elastic.co/guide/en/elasticsearch/reference/current/defining-roles.html#roles-indices-priv) which is inadvisable. > Restricted indices are a special category of indices that are used internally to store configuration data. Only internal system roles should normally grant privileges over the restricted indices. **Toggling this flag is most discouraged because it could effectively grant superuser privileges.** If however, for administrative purposes, you need to create a role with privileges covering restricted indices, you must set this field to `true` (default is `false` ), and then the `names` field will cover the restricted indices as well. There may be a way to achieve this through some custom [application privilege](https://www.elastic.co/guide/en/elasticsearch/reference/6.8/security-privileges.html#application-privileges) or indices privilege assigned to a custom [elasticsearch role](https://www.elastic.co/guide/en/elasticsearch/reference/6.8/security-api-put-role.html) but those rules require [`privileges`](https://www.elastic.co/guide/en/elasticsearch/reference/6.8/security-privileges.html#privileges-list-indices) that are all meant to allow access not deny. In this case, the user already does **not** have access to the restricted indices except for their own credentials. Hope that helps. ---
**Author:** ![syogo](https://avatars.discourse-cdn.com/v4/letter/s/50afbb/32.png) [@syogo](https://discuss.elastic.co/u/syogo)\ **Post date:** [March 12, 2021, 4:54am UTC](https://discuss.elastic.co/t/topic/264210/3 "2021-03-12T04:54:50Z")
返信していただきありがとうございます．素直に諦めます，ありがとうございました． ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [March 16, 2021, 3:31am UTC](https://discuss.elastic.co/t/topic/264210/4 "2021-03-16T03:31:11Z")
> [@](#): > > How can I prevent the user from going to the Account Settings page in the figure when logging in with an account named A that has [kibana\_dashboard\_only\_user]? This page is only shown for users who login via the `native` realm. If you create a file in another realm - such as the `file` realm, then they cannot change their password in Kibana. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 13, 2021, 3:31am UTC](https://discuss.elastic.co/t/topic/264210/5 "2021-04-13T03:31:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.