Direct access to Kibana/Elastic

[xde012]

Hi,
it is possible to access Kibana / Elastic directly, without having to log in to SO first.

The idea is to use Kibana / Elastic as a viewer for multiple users with different roles, which I am going to create directly in Elastic, saving creating users in SOC.

The problem is that when trying to access the URL https://IP-SOC/Kibana it always redirects me to the initial Security Onion login.

Is there a way to log in directly to Kibana / Elastic?

Thank you!

[EddieN17]

In /opt/so/saltstack/default/salt/nginx/etc/nginx.conf You can modify the conf to remove the Security Onion authentication.

location /kibana/ {
                        auth_request          /auth/sessions/whoami;
                        rewrite               /kibana/(.*) /$1 break;
                        proxy_pass            http://{{ manager_ip }}:5601/;

Remove the auth_request /auth/sessions/whoami; line. Then run so-nginx-restart. The Security Onion authentication should be gone and the Elastic authentication persists for just the https://IP-SOC/kibana location.

[xde012]

It is right.
But a reboot is not necessary. I have tried and let me log in without problems.

This configuration will endure/remain updates. sudo soup ?

Thank you very much!!