Introduction
The easiest way to protect your Kibana control panel from malicious intruders is to set up an Nginx reverse proxy. By doing so, you ensure that only password-protected authorized users can access Kibana (and Elasticsearch data).
In this tutorial, you will learn how to configure Nginx reverse proxy for Kibana.
prerequisites
A
- working ELK stack installed in the system A
- user account with sudo privileges Access
- a terminal/command line window
to
Configure Nginx
reverse proxy
for Kibana
Step 1: Set up
Kibana Before
you start configuring Nginx, be sure to edit the Kibana and Elasticsearch configuration files
.
1. First, open
the Kibana configuration file by running: sudo vim /etc/kibana/kibana.yml
If you followed the steps described in the Kibana installation, the file should look similar to the one shown below
.
2. Change the default server port and server host address to the following values: server.host:”localhost” server.port
:5601
3. Then, save and exit the file.
4. Restart the Kibana service with the command: sudo service kibana
restart
Step 2: Configure Elasticsearch
1. Repeat the same process for Elasticsearch. Open your configuration file:
sudo vim /etc/elasticsearch/elasticsearch.yml
2. Then locate the following lines and change the default port and
host: http.port: 9200 network.host: localhost
3. Save the file and restart the service:
sudo service elasticsearch restart
4. Finally, verify that you can access Kibana by navigating to the following URL in a browser
: http://localhost:5601
Step 3: Install and configure
Nginx
The next step is to set up Nginx
.
1. If you haven’t installed Nginx yet, run the command:
sudo apt-get install nginx
2. Once you configure Nginx, install apache2-utils, a utility for creating password-protected accounts: sudo apt-get install apache2-utils
3. Then, create a user account that you want to use to access Kibana. Replace user_account in the command with the user name you want to use:
sudo htpasswd -c /etc/nginx/htpasswd.users user_account
4. The output then prompts you to provide and retype
a password for this user: New password: Retype a new password: Add password for user
user_account 5. Next, create a configuration file for Nginx:
sudo vim /etc/nginx/conf.d/kibana.conf
6. Add the following content once inside the text editor:
worker_processes 1; events { worker_connections 1024; } http { upstream elasticsearch { server 127.0.0.1:9200; keepalive 15; } upstream kibana { server 127.0.0.1:5601; keepalive 15; } server { listen 8881; location / { auth_basic “Restricted Access”; auth_basic_user_file /etc/nginx/htpasswd.users; proxy_pass http://elasticsearch; proxy_redirect off; proxy_buffering off; proxy_http_version 1.1; proxy_set_header Connection “Keep-Alive”; proxy_set_header proxy-connection “Keep-alive”; } } server { listen 8882; location / { auth_basic “Restricted Access”; auth_basic_user_file /etc/nginx/htpasswd.users; proxy_pass http://kibana; proxy_redirect off; proxy_buffering off; proxy_http_version 1.1; proxy_set_header Connection “Keep-Alive”; proxy_set_header Proxy-Connection “Keep-Alive”; } } }
7. Save and exit the file.
Step 4: Restart
the services
You must restart the services for them to recognize the new settings
.
1. Restart Nginx by running: sudo service nginx
restart
2. Then, restart the Kibana service with the command: sudo service kibana
restart
Step 5: Confirm that authentication is working properly
1. Open a web browser and navigate to the IP address you assigned to Kibana.
2. An authentication window appears asking you to provide a username and password.
3. Enter the credentials configured when setting up Nginx and select Login. If you’ve provided the correct information, your browser opens the Kibana welcome page.
Conclusion
If you followed this guide, you should have successfully configured the Nginx reverse proxy for Kibana. This provides an additional layer of security that protects data managed through Kibana.
Your next step should be to review the Kibana features used for visualization in our Kibana tutorial.
