# Search Guard Kibana plugin **URL:** \ **Category:** Search Guard\ **Created:** [August 9, 2018, 5:20pm UTC](https://forum.search-guard.com/t/search-guard-kibana-plugin/1066 "2018-08-09T17:20:33Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Rudra](https://avatars.discourse-cdn.com/v4/letter/r/47e85d/32.png) [@Rudra](https://forum.search-guard.com/u/Rudra)\ **Post date:** [August 9, 2018, 5:20pm UTC](https://forum.search-guard.com/t/search-guard-kibana-plugin/1066/1 "2018-08-09T17:20:33Z")
When asking questions, please provide the following information: - Search Guard and Elasticsearch version - Installed and used enterprise modules, if any - JVM version and operating system version - Search Guard configuration files - Elasticsearch log messages on debug level - Other installed Elasticsearch or Kibana plugins, if any I am using SearchGuard Enterprise License 6.1.1 version , Will this license include “Search Guard Kibana plugin” or need additional cost? ---
**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\ **Post date:** [August 9, 2018, 8:38pm UTC](https://forum.search-guard.com/t/search-guard-kibana-plugin/1066/2 "2018-08-09T20:38:28Z")
The Kibana Plugin is licensed under Apache2, so you are free to use and modify it without any cost. > **···** > > On Thursday, August 9, 2018 at 7:20:33 PM UTC+2, rud wrote: > > > When asking questions, please provide the following information: > > > - Search Guard and Elasticsearch version > > > - Installed and used enterprise modules, if any > > > - JVM version and operating system version > > > - Search Guard configuration files > > > - Elasticsearch log messages on debug level > > > - Other installed Elasticsearch or Kibana plugins, if any > > > > > > I am using SearchGuard Enterprise License 6.1.1 version , Will this license include “Search Guard Kibana plugin” > > > > > > or need additional cost? ---
**Author:** ![Rudra](https://avatars.discourse-cdn.com/v4/letter/r/47e85d/32.png) [@Rudra](https://forum.search-guard.com/u/Rudra)\ **Post date:** [August 9, 2018, 9:51pm UTC](https://forum.search-guard.com/t/search-guard-kibana-plugin/1066/3 "2018-08-09T21:51:48Z")
Thank You , I have kibana is already installed in my environment.(Please find the screenshot)but there is no searchguard configuration GUI. Now I am trying to install the download plugin to get the SG UI with below. ```auto ``` - Stop Kibana - cd into your Kibana installation directory. - Execute:bin/kibana-plugin install search-guard-kibana-plugin-6.1.1-12.zip My current configuration is below –elasticsearch.yml----- ```auto #: SG - Https for client nodes only searchguard.ssl.http.enabled: false ``` ```auto ``` ```auto ``` searchguard.ssl.transport.enforce\_hostname\_verification: false searchguard.ssl.transport.resolve\_hostname: false ```auto ``` —sg\_config.yml---- ```auto ``` ```auto ``` ```auto searchguard: dynamic: kibana: multitenancy_enabled: true server_username: "bdm156" index: ".kibana" do_not_fail_on_forbidden: false http: anonymous_auth_enabled: false xff: enabled: false internalProxies: "192\\.168\\.0\\.10|192\\.168\ \.0\\.11" remoteIpHeader: "X-Forwarded-For" proxiesHeader: "X-Forwarded-By" ``` ```auto ``` ``` authc: ``` ldap: enabled: true order: 1 http\_authenticator: type: “basic” challenge: tru e authentication\_backend: type: “ldap” ```auto ``` ```auto clientcert_auth_domain: enabled: true order: 0 http_authenticator: type: "clientcert" challenge: false config: username_attribute: "cn" authentication_backend: type: "noop" ``` ```auto ``` ``` authz: ``` roles\_from\_myldap: enabled: true authorization\_backend: type: “ldap” config: enable\_ssl: false enable\_start\_tls: false enable\_ssl\_client\_auth: false verify\_hostnames: false ```auto ``` ```auto ``` ----kibana.yml— ```auto ``` ```auto ``` searchguard.basicauth.enabled: true #: https must be enabled for below searchguard.cookie.secure: true ```auto ``` # Multitenancy ![](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/1X/8efb91d2f63928a9ae707e9324292e39e84dd6b8.png) > **···** > > # > > searchguard.multitenancy.enabled: true > searchguard.multitenancy.tenants.enable\_global: true > searchguard.multitenancy.tenants.enable\_private: true > > ```auto > > ``` > > ```auto > > ``` > > elasticsearch.requestHeadersWhitelist: [ “sg\_tenant”, “X-Authenticated-User”, “Authorization”, “X-Forwarded-For”, “X-Forwarded-Server”, "X-Forwarded-By > , “X-Proxy-User”, “X-Proxy-Roles”, “X-Client-Cert” ] > > ```auto > > ``` > > ```auto > - 1)will it automatically update the kibana (for searchguard gui)as soon as i install with out cluster restart? > - 2)Do i need to add any other configurations before installing the plugin? > > 3)which access i need to install? anything to do with below. > > If you have [restricted certain endpoints](https://docs.search-guard.com/latest/rest-api-access-control) for the currently logged in user, the plugin will automatically disable these features. > > For everything to work, the logged in user should have: > > - Access to the `ACTIONGROUPS` endpoint with `GET` method > - Otherwise, autocompletion of action groups will not work > - the permission `indices:admin/validate/query` on all indices > - Otherwise, the syntax check for DLS queries will not work > > - > > On Thursday, August 9, 2018 at 3:38:28 PM UTC-5, Jochen Kressin wrote: > > The Kibana Plugin is licensed under Apache2, so you are free to use and modify it without any cost. > > > > On Thursday, August 9, 2018 at 7:20:33 PM UTC+2, rud wrote: > > > When asking questions, please provide the following information: > > > > > > > * Search Guard and Elasticsearch version > > > > * Installed and used enterprise modules, if any > > > > * JVM version and operating system version > > > > * Search Guard configuration files > > > > * Elasticsearch log messages on debug level > > > > * Other installed Elasticsearch or Kibana plugins, if any > > > > > > > > I am using SearchGuard Enterprise License 6.1.1 version , Will this license include "Search Guard Kibana plugin" > > > > > > > > or need additional cost? > > > ``` ---
**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\ **Post date:** [August 10, 2018, 9:02am UTC](https://forum.search-guard.com/t/search-guard-kibana-plugin/1066/4 "2018-08-10T09:02:19Z")
you need to configure the roles that should have access to the GUI in elasticsearch: searchguard.restapi.roles\_enabled: [“sg\_all\_access”, …] `` ([Configuration GUI | Security for Elasticsearch | Search Guard](https://docs.search-guard.com/latest/configuration-gui)) Also, in sg\_config.yml you configured: ````auto server_username: "bdm156" What is this user? Have you configured it in kibana.yml?
··· On Thursday, August 9, 2018 at 11:47:20 PM UTC+2, rud wrote: > Thank You , I have kibana is already installed in my environment.(Please find the screenshot)but there is no searchguard configuration GUI. > > Now I am trying to install the download plugin to get the SG UI with below. > > ``` > > ``` > - Stop Kibana > - cd into your Kibana installation directory. > - Execute:bin/kibana-plugin install search-guard-kibana-plugin-6.1.1-12.zip > > My current configuration is below > > --elasticsearch.yml----- > > ``` > #: SG - Https for client nodes only > searchguard.ssl.http.enabled: false > ``` > ``` > > > ``` > ``` > ``` > searchguard.ssl.transport.enforce_hostname_verification: false > searchguard.ssl.transport.resolve_hostname: false > ``` > ``` > ---sg_config.yml---- > > ``` > ``` > > > ``` > ``` > ``` > searchguard: > dynamic: > kibana: > multitenancy_enabled: true > server_username: "bdm156" > index: ".kibana" > do_not_fail_on_forbidden: false > http: > anonymous_auth_enabled: false > xff: > enabled: false > internalProxies: "192\\.168\\.0\\.10|192\\.168\ \.0\\.11" > remoteIpHeader: "X-Forwarded-For" > proxiesHeader: "X-Forwarded-By" > ``` > ``` > ``` > authc: > ldap: > enabled: true > order: 1 > http_authenticator: > type: "basic" > challenge: tru e > authentication_backend: > type: "ldap" > ``` > ``` > ``` > clientcert_auth_domain: > enabled: true > order: 0 > http_authenticator: > type: "clientcert" > challenge: false > config: > username_attribute: "cn" > authentication_backend: > type: "noop" > ``` > ``` > ``` > authz: > roles_from_myldap: > enabled: true > authorization_backend: > type: "ldap" > config: > enable_ssl: false > enable_start_tls: false > enable_ssl_client_auth: false > verify_hostnames: false > ``` > ``` > > > ``` > ``` > ----kibana.yml--- > ``` > ``` > > > ``` > ``` > searchguard.basicauth.enabled: true > #: https must be enabled for below > searchguard.cookie.secure: true > > ``` > ``` > # Multitenancy > # > searchguard.multitenancy.enabled: true > searchguard.multitenancy.tenants.enable_global: true > searchguard.multitenancy.tenants.enable_private: true > > ``` > > ``` > > > ``` > ``` > elasticsearch.requestHeadersWhitelist: [ "sg_tenant", "X-Authenticated-User", "Authorization", "X-Forwarded-For", "X-Forwarded-Server", "X-Forwarded-By > , "X-Proxy-User", "X-Proxy-Roles", "X-Client-Cert" ] > ``` > ``` > > ``` > - 1)will it automatically update the kibana (for searchguard gui)as soon as i install with out cluster restart? > - 2)Do i need to add any other configurations before installing the plugin? > > 3)which access i need to install? anything to do with below. > If you have [restricted certain endpoints](https://docs.search-guard.com/latest/rest-api-access-control) for the currently logged in user, the plugin will automatically disable these features. > For everything to work, the logged in user should have: > - Access to the `ACTIONGROUPS` endpoint with `GET` method > - Otherwise, autocompletion of action groups will not work > - the permission `indices:admin/validate/query` on all indices > - Otherwise, the syntax check for DLS queries will not work > - > On Thursday, August 9, 2018 at 3:38:28 PM UTC-5, Jochen Kressin wrote: > > The Kibana Plugin is licensed under Apache2, so you are free to use and modify it without any cost. > > > > On Thursday, August 9, 2018 at 7:20:33 PM UTC+2, rud wrote: > > > When asking questions, please provide the following information: > > > > > > * Search Guard and Elasticsearch version > > > * Installed and used enterprise modules, if any > > > * JVM version and operating system version > > > * Search Guard configuration files > > > * Elasticsearch log messages on debug level > > > * Other installed Elasticsearch or Kibana plugins, if any > > > > > > I am using SearchGuard Enterprise License 6.1.1 version , Will this license include "Search Guard Kibana plugin" > > > > > > or need additional cost?
```` ---
**Author:** ![Rudra](https://avatars.discourse-cdn.com/v4/letter/r/47e85d/32.png) [@Rudra](https://forum.search-guard.com/u/Rudra)\ **Post date:** [August 10, 2018, 10:25pm UTC](https://forum.search-guard.com/t/search-guard-kibana-plugin/1066/5 "2018-08-10T22:25:21Z")
bdm156 is Kibana Server User (for authenticating to ES) in sg\_cpnfig.yml but It’s not in kibana.yml. > **···** > > On Fri, Aug 10, 2018 at 4:02 AM, Jochen Kressin [jkressin@floragunn.com](mailto:jkressin@floragunn.com) wrote: > > > you need to configure the roles that should have access to the GUI in elasticsearch: > > > searchguard.restapi.roles\_enabled: [“sg\_all\_access”, …] > > > `` > > > ([https://docs.search-guard.com/latest/configuration-gui](https://docs.search-guard.com/latest/configuration-gui)) > > > > > > Also, in sg\_config.yml you configured: > > > > > > ```auto > > server_username: "bdm156" > > > > ``` > > > > > > What is this user? Have you configured it in kibana.yml? > > > On Thursday, August 9, 2018 at 11:47:20 PM UTC+2, rud wrote: > > > > Thank You , I have kibana is already installed in my environment.(Please find the screenshot)but there is no searchguard configuration GUI. > > > > Now I am trying to install the download plugin to get the SG UI with below. > > > > > > > > ```auto > > > > > > ``` > > > > > > - Stop Kibana > > > - cd into your Kibana installation directory. > > > - Execute:bin/kibana-plugin install search-guard-kibana-plugin-6.1.1-12.zip > > > > My current configuration is below > > > > > > > > –elasticsearch.yml----- > > > > > > > > ```auto > > > #: SG - Https for client nodes only > > > searchguard.ssl.http.enabled: false > > > > > > ``` > > > > > > ```auto > > > > > > ``` > > > > > > ```auto > > > > > > ``` > > > > > > searchguard.ssl.transport.enforce\_hostname\_verification: false > > > searchguard.ssl.transport.resolve\_hostname: false > > > > > > ```auto > > > > > > ``` > > > > > > —sg\_config.yml---- > > > > > > ```auto > > > > > > ``` > > > > > > ```auto > > > > > > ``` > > > > > > ```auto > > > searchguard: > > > dynamic: > > > kibana: > > > multitenancy_enabled: true > > > server_username: "bdm156" > > > index: ".kibana" > > > do_not_fail_on_forbidden: false > > > http: > > > anonymous_auth_enabled: false > > > xff: > > > enabled: false > > > internalProxies: "192\\.168\\.0\\.10|192\\.168\ \.0\\.11" > > > remoteIpHeader: "X-Forwarded-For" > > > proxiesHeader: "X-Forwarded-By" > > > > > > ``` > > > > > > ```auto > > > > > > ``` > > > > > > ``` > > > authc: > > > > > > ``` > > > > > > ldap: > > > enabled: true > > > order: 1 > > > http\_authenticator: > > > type: “basic” > > > challenge: tru e > > > authentication\_backend: > > > type: “ldap” > > > > > > ```auto > > > > > > ``` > > > > > > ```auto > > > clientcert_auth_domain: > > > enabled: true > > > order: 0 > > > http_authenticator: > > > type: "clientcert" > > > challenge: false > > > config: > > > username_attribute: "cn" > > > authentication_backend: > > > type: "noop" > > > > > > ``` > > > > > > ```auto > > > > > > ``` > > > > > > ``` > > > authz: > > > > > > ``` > > > > > > roles\_from\_myldap: > > > enabled: true > > > authorization\_backend: > > > type: “ldap” > > > config: > > > enable\_ssl: false > > > enable\_start\_tls: false > > > enable\_ssl\_client\_auth: false > > > verify\_hostnames: false > > > > > > ```auto > > > > > > ``` > > > > > > ```auto > > > > > > ``` > > > > > > ----kibana.yml— > > > > > > ```auto > > > > > > ``` > > > > > > ```auto > > > > > > ``` > > > > ```auto > > > searchguard.basicauth.enabled: true > > > #: https must be enabled for below > > > searchguard.cookie.secure: true > > > > > > ``` > > > > > > ```auto > > > # Multitenancy > > > # > > > searchguard.multitenancy.enabled: true > > > searchguard.multitenancy.tenants.enable_global: true > > > searchguard.multitenancy.tenants.enable_private: true > > > > > > ``` > > > > ```auto > > > > > > ``` > > > > > > ```auto > > > elasticsearch.requestHeadersWhitelist: [ "sg_tenant", "X-Authenticated-User", "Authorization", "X-Forwarded-For", "X-Forwarded-Server", "X-Forwarded-By > > > , "X-Proxy-User", "X-Proxy-Roles", "X-Client-Cert" ] > > > > > > ``` > > > > > > ```auto > > > > > > ``` > > > > > > - 1)will it automatically update the kibana (for searchguard gui)as soon as i install with out cluster restart? > > > - 2)Do i need to add any other configurations before installing the plugin? > > > > 3)which access i need to install? anything to do with below. > > > > If you have [restricted certain endpoints](https://docs.search-guard.com/latest/rest-api-access-control) for the currently logged in user, the plugin will automatically disable these features. > > > > For everything to work, the logged in user should have: > > > > - Access to the `ACTIONGROUPS` endpoint with `GET` method > > > - Otherwise, autocompletion of action groups will not work > > > - the permission `indices:admin/validate/query` on all indices > > > - Otherwise, the syntax check for DLS queries will not work > > > > - > > > > On Thursday, August 9, 2018 at 3:38:28 PM UTC-5, Jochen Kressin wrote: > > > > > > > The Kibana Plugin is licensed under Apache2, so you are free to use and modify it without any cost. > > > > > > > > On Thursday, August 9, 2018 at 7:20:33 PM UTC+2, rud wrote: > > > > > > > > > When asking questions, please provide the following information: > > > > > > - Search Guard and Elasticsearch version > > > > > > - Installed and used enterprise modules, if any > > > > > > - JVM version and operating system version > > > > > > - Search Guard configuration files > > > > > > - Elasticsearch log messages on debug level > > > > > > - Other installed Elasticsearch or Kibana plugins, if any > > > > > > > > > > > > I am using SearchGuard Enterprise License 6.1.1 version , Will this license include “Search Guard Kibana plugin” > > > > > > > > > > > > or need additional cost? > > > – > > > > You received this message because you are subscribed to a topic in the Google Groups “Search Guard Community Forum” group. > > > > To unsubscribe from this topic, visit [https://groups.google.com/d/topic/search-guard/g3SDu6-bID4/unsubscribe](https://groups.google.com/d/topic/search-guard/g3SDu6-bID4/unsubscribe). > > > > To unsubscribe from this group and all its topics, send an email to [search-guard+unsubscribe@googlegroups.com](mailto:search-guard+unsubscribe@googlegroups.com). > > > > To post to this group, send email to [search-guard@googlegroups.com](mailto:search-guard@googlegroups.com). > > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/3e5a67aa-83f2-4f36-8a6d-91ed82d484d6%40googlegroups.com](https://groups.google.com/d/msgid/search-guard/3e5a67aa-83f2-4f36-8a6d-91ed82d484d6%40googlegroups.com?utm_medium=email&utm_source=footer). > > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).