# Disable Access of Kibana Server Status API \[api/status\] **URL:** \ **Category:** Security\ **Created:** [October 26, 2021, 6:52am UTC](https://forum.opensearch.org/t/disable-access-of-kibana-server-status-api-api-status/7431 "2021-10-26T06:52:45Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Abb](https://avatars.discourse-cdn.com/v4/letter/a/47e85d/32.png) [@Abb](https://forum.opensearch.org/u/Abb)\ **Post date:** [October 26, 2021, 6:52am UTC](https://forum.opensearch.org/t/disable-access-of-kibana-server-status-api-api-status/7431/1 "2021-10-26T06:52:45Z")
We have ElasticSearch Setup, and noticed that **URL/api/status** is being accessed publicly without being authenticated and this is sitting behind the load balancer. However URL/api or URL/status throws unauthorised message as below > {“statusCode”:401,“error”:“Unauthorized”,“message”:“Unauthorized”} Do we need to have extra setting to disable public access on **/api/status** ---
**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\ **Post date:** [October 26, 2021, 9:51am UTC](https://forum.opensearch.org/t/disable-access-of-kibana-server-status-api-api-status/7431/2 "2021-10-26T09:51:12Z")
@Abb Do you mean `https://localhost:9200/api/status` ? If so, what response do you get? ---
**Author:** ![Abb](https://avatars.discourse-cdn.com/v4/letter/a/47e85d/32.png) [@Abb](https://forum.opensearch.org/u/Abb)\ **Post date:** [October 26, 2021, 10:19am UTC](https://forum.opensearch.org/t/disable-access-of-kibana-server-status-api-api-status/7431/3 "2021-10-26T10:19:19Z")
@pablo Yes, but its not localhost:9200, rather it on the Production. [https://someProdURL/api/status](https://someProdURL/api/status) gives me the complete JSON-formatted server status details in response as mentioned here : [Access Kibana | Kibana Guide [8.4] | Elastic](https://www.elastic.co/guide/en/kibana/current/access.html#status) But [https://someProdURL/api](https://someProdURL/api) or [https://someProdURL/status](https://someProdURL/status) returns `{“statusCode”:401,“error”:“Unauthorized”,“message”:“Unauthorized”}` We tried these below settings in kibana.yml but still no luck ```auto server.xsrf.disableProtection: false status.allowAnonymous: false opendistro_security.auth.anonymous_auth_enabled: false ``` ---
**Author:** ![oscark](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/oscark/32/866_2.png) [@oscark](https://forum.opensearch.org/u/oscark)\ **Post date:** [October 26, 2021, 10:45am UTC](https://forum.opensearch.org/t/disable-access-of-kibana-server-status-api-api-status/7431/4 "2021-10-26T10:45:04Z")
My original issue for opendistro: [https://github.com/opensearch-project/security-dashboards-plugin/issues/579](https://github.com/opensearch-project/security-dashboards-plugin/issues/579) > I have not updated to opensearch yet but I think the solution is to set `auth.unauthenticated_routes: []` in opensearch dashboard configuration. ---
**Author:** ![Abb](https://avatars.discourse-cdn.com/v4/letter/a/47e85d/32.png) [@Abb](https://forum.opensearch.org/u/Abb)\ **Post date:** [October 26, 2021, 10:52am UTC](https://forum.opensearch.org/t/disable-access-of-kibana-server-status-api-api-status/7431/5 "2021-10-26T10:52:59Z")
@oscark `auth.unauthenticated_routes: []` is this setting to be used in kibana.yml? and does opendistro support it? ---
**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\ **Post date:** [October 26, 2021, 11:27am UTC](https://forum.opensearch.org/t/disable-access-of-kibana-server-status-api-api-status/7431/6 "2021-10-26T11:27:12Z")
@Abb Try `opensearch_security.auth.unauthenticated_routes: []` ---
**Author:** ![Abb](https://avatars.discourse-cdn.com/v4/letter/a/47e85d/32.png) [@Abb](https://forum.opensearch.org/u/Abb)\ **Post date:** [October 26, 2021, 12:27pm UTC](https://forum.opensearch.org/t/disable-access-of-kibana-server-status-api-api-status/7431/7 "2021-10-26T12:27:46Z")
@pablo @oscark I tried the above setting… Still able to access the api ---
**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\ **Post date:** [October 26, 2021, 12:45pm UTC](https://forum.opensearch.org/t/disable-access-of-kibana-server-status-api-api-status/7431/8 "2021-10-26T12:45:52Z")
@Abb Could you send your config? This worked for me. `opensearch_security.auth.unauthenticated_routes: []` This option has to go with empty brackets. ---
**Author:** ![oscark](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/oscark/32/866_2.png) [@oscark](https://forum.opensearch.org/u/oscark)\ **Post date:** [October 26, 2021, 2:09pm UTC](https://forum.opensearch.org/t/disable-access-of-kibana-server-status-api-api-status/7431/9 "2021-10-26T14:09:48Z")
So I think that opensearch should be (as Pablo wrote): `opensearch_security.auth.unauthenticated_routes: []` And opendistro should use: `opendistro_security.auth.unauthenticated_routes: []` ---
**Author:** ![Abb](https://avatars.discourse-cdn.com/v4/letter/a/47e85d/32.png) [@Abb](https://forum.opensearch.org/u/Abb)\ **Post date:** [October 27, 2021, 10:38am UTC](https://forum.opensearch.org/t/disable-access-of-kibana-server-status-api-api-status/7431/10 "2021-10-27T10:38:19Z")
@oscark @pablo Using `opendistro_security.auth.unauthenticated_routes: []` did work for me but now the kubernetes kibana Deployment fails as readiness probe in `kibana-deployment.yml` file uses `/api/status/` to check kibana pod readiness. ```auto readinessProbe: httpGet: path: /api/status port: http scheme: HTTPS initialDelaySeconds: 60 periodSeconds: 30 ``` Here are Logs of Kibana: ```auto "method":"get","statusCode":401,"req":{"url":"/api/status","method":"get","headers":{"host":"10.xxx.x.xxx:5601","user-agent":"kube-pro │ │ be/1.19","accept-encoding":"gzip","connection":"close"},"remoteAddress":"10.xxx.x.xxx","userAgent":"kube-probe/1.19"},"res":{"statusCode":401,"responseTime":10,"contentLength":9},"message":"GET /api/status 401 10 │ │ ms - 9.0B"} ``` Do we have any reason Opendistro has bydefault open `api/status` endpoint not `/api` or `/status`,what is the intention behind keeping only api/status open and not others? However was curious to explore on the response that we received from `/api/status/` is it ok to expose to public users?