Configure security in Kibana

Self Managed

This document describes security settings you may need to configure in self-managed deployments of Kibana. These settings help secure access, manage connections, and ensure consistent behavior across multiple instances.

Additional Kibana security features that apply to all deployment types, such as session management, saved objects encryption, and audit logging, are covered in a separate section at the end of this document.

Set an encryption key so that sessions are not invalidated. You can optionally configure additional security settings and authentication.

1. Set the xpack.security.encryptionKey property in the kibana.yml configuration file. You can use any text string that is 32 characters or longer as the encryption key. Refer to xpack.security.encryptionKey.

   xpack.security.encryptionKey: "something_at_least_32_characters"
   

   Kibana's reporting and saved objects features also have encryption key settings. Refer to xpack.reporting.encryptionKey and xpack.encryptedSavedObjects.encryptionKey respectively.

2. Optional: Configure Kibana's session expiration settings.

3. Restart Kibana.

The Kibana server can instruct browsers to enable additional security controls using HTTP headers.

1. Enable HTTP Strict Transport Security (HSTS).

   Use strictTransportSecurity to ensure that browsers will only attempt to access Kibana with SSL/TLS encryption. This is designed to prevent manipulator-in-the-middle attacks. To configure this with a lifetime of one year in your kibana.yml:

   server.securityResponseHeaders.strictTransportSecurity: "max-age=31536000"
   

   Warning

   This header will block unencrypted connections for the entire domain. If you host more than one web application on the same domain using different ports or paths, all of them will be affected.

2. Disable embedding.

   Use disableEmbedding to ensure that Kibana cannot be embedded in other websites. To configure this in your kibana.yml:

   server.securityResponseHeaders.disableEmbedding: true
   

Kibana uses a Content Security Policy (CSP) to prevent the browser from allowing unsafe scripting, but older browsers will silently ignore this policy. If your organization does not need to support very old versions of our supported browsers, we recommend that you enable Kibana's strict mode for the CSP. This will block access to Kibana for any browser that does not enforce even a rudimentary set of CSP protections.

To do this, set csp.strict to true in your kibana.yml:

csp.strict: true

For guidance on managing user access to Kibana, refer to Kibana privileges and Cluster or deployment users.

For TLS encryption configuration, refer to Set up HTTPS > Encrypt traffic between your browser and Kibana.

The following Kibana security features are not covered in this document because they apply to all deployment types, not just self-managed ones. However, they’re also important to consider:

• Session management
• Saved objects encryption
• Secure settings
• Security events audit logging

For a complete overview of available security features, refer to Secure your cluster or deployment.