forked from bdwilson/ELK
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathkibana.conf
65 lines (49 loc) · 2 KB
/
kibana.conf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
# Below is a small example of a /etc/httpd/conf.d/kibana.conf file.
# This is one way to help provide security on various Kibana websites. Within the Kibana dashboard,
# you can disable the ability to edit the page and then set it only to allow a specific index that
# the particular group will need access to (i.e kibana-unix only has access to the ES unix index).
<Directory /var/www/html/kibana>
SSLRequireSSL
</Directory>
ProxyRequests off
ProxyPass /elasticsearch/ http://192.168.1.10:9200/
<Location /elasticsearch/>
ProxyPassReverse /
SSLRequireSSL
</Location>
<AuthnProviderAlias ldap ldap-domain>
AuthLDAPURL "ldap://server.domain.com:3268/DC=XXX,DC=YYY,DC=com?sAMAccountName??(!(userAccountControl:1.2.840.113556.1.4.803:=2))"
AuthLDAPBindDN "cn=Bind_Name,cn=Users,dc=XX,dc=YYY,dc=com"
AuthLDAPBindPassword ThisIsthePassword
</AuthnProviderAlias>
<Location /kibana-helpdesk>
AuthType Basic
AuthName "USE WINDOWS PASSWORD"
AuthBasicProvider ldap-domain
AuthLDAPRemoteUserAttribute sAMAccountName
AuthLDAPBindDN "cn=Bind_Name,cn=Users,dc=XX,dc=YYY,dc=com"
AuthLDAPBindPassword ThisIsthePassword
AuthLDAPURL "ldap://domain:3268/DC=XX,DC=YYY,DC=com?sAMAccountName"
Require ldap-group CN=Help Desk,OU=Groups,DC=XX,DC=YYY,DC=com
Require ldap-group CN=Security Team,OU=Groups,DC=XX,DC=YYY,DC=com
<IfVersion <= 2.2>
AuthzLDAPAuthoritative On
</IfVersion>
order allow,deny
allow from all
</Location>
<Location /kibana-unix>
AuthType Basic
AuthName "USE WINDOWS PASSWORD"
AuthBasicProvider ldap-domain
AuthLDAPRemoteUserAttribute sAMAccountName
AuthLDAPBindDN "cn=Bind_Name,cn=Users,dc=XX,dc=YYY,dc=com"
AuthLDAPBindPassword ThisIsthePassword
AuthLDAPURL "ldap://domain:3268/DC=XX,DC=YYY,DC=com?sAMAccountName"
Require ldap-group CN=UNIX Admins,OU=Groups,DC=XX,DC=YYY,DC=com
Require ldap-group CN=Security Team,OU=Groups,DC=XX,DC=YYY,DC=com
<IfVersion <= 2.2>
AuthzLDAPAuthoritative On
</IfVersion>
order allow,deny
allow from all