# Restricting ananymous user from seeing System Information

**URL:** https://community.sonatype.com/t/restricting-ananymous-user-from-seeing-system-information/5818
**Category:** Sonatype Nexus Repository
**Created:** [February 3, 2021, 6:57pm UTC](https://community.sonatype.com/t/restricting-ananymous-user-from-seeing-system-information/5818 "2021-02-03T18:57:21Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![ijunaidsubhani](https://avatars.discourse-cdn.com/v4/letter/i/ea666f/32.png) [@ijunaidsubhani](https://community.sonatype.com/u/ijunaidsubhani)
#### Post date: [February 3, 2021, 6:57pm UTC](https://community.sonatype.com/t/restricting-ananymous-user-from-seeing-system-information/5818/1 "2021-02-03T18:57:21Z")

</div>

Hello

I am operating Nexus Repository Manager. Currently the repositories are configured to be secure. But if someone access the UI without logging in, they can click on “Server configuration and Management” and then click on “System Information” under Support. That is an issue since it displays environment variables and some of them carry credentials.

How can I stop anonymous user from navigating to those pages ?

Regards

---

<div class="post-metadata">

### Author: ![mmartz](https://avatars.discourse-cdn.com/v4/letter/m/e9bcb4/32.png) [@mmartz](https://community.sonatype.com/u/mmartz)
#### Post date: [February 3, 2021, 7:35pm UTC](https://community.sonatype.com/t/restricting-ananymous-user-from-seeing-system-information/5818/2 "2021-02-03T19:35:46Z")

</div>

They should not be exposed by default. Check your anonymous access configuration to see which user is used for anonymous users.

---

<div class="post-metadata">

### Author: ![ijunaidsubhani](https://avatars.discourse-cdn.com/v4/letter/i/ea666f/32.png) [@ijunaidsubhani](https://community.sonatype.com/u/ijunaidsubhani)
#### Post date: [February 3, 2021, 8:10pm UTC](https://community.sonatype.com/t/restricting-ananymous-user-from-seeing-system-information/5818/4 "2021-02-03T20:10:22Z")

</div>

![Screen Shot 2021-02-03 at 3.09.43 PM](https://canada1.discourse-cdn.com/flex047/uploads/communitysonatype/original/2X/f/f6021f9d306233b7e5abcc42bd9f0cabf4e72cd6.png)

---

<div class="post-metadata">

### Author: ![ijunaidsubhani](https://avatars.discourse-cdn.com/v4/letter/i/ea666f/32.png) [@ijunaidsubhani](https://community.sonatype.com/u/ijunaidsubhani)
#### Post date: [February 3, 2021, 8:13pm UTC](https://community.sonatype.com/t/restricting-ananymous-user-from-seeing-system-information/5818/5 "2021-02-03T20:13:20Z")

</div>

So i just checked. The anonymous user is granted the nx-anonymous role.

The nx-anonymous role is granted the following privileges :

```
nx-healthcheck-read
nx-repository-view-*-*-browse
nx-repository-view-*-*-read
nx-search-read
```

---

<div class="post-metadata">

### Author: ![mpiggott](https://avatars.discourse-cdn.com/v4/letter/m/f0a364/32.png) [@mpiggott](https://community.sonatype.com/u/mpiggott)
#### Post date: [February 3, 2021, 8:14pm UTC](https://community.sonatype.com/t/restricting-ananymous-user-from-seeing-system-information/5818/6 "2021-02-03T20:14:33Z")

</div>

Checking locally even navigating directly to the System Information URL.

I’d suggest you might have a session from another tab or some sort of caching or reverse caching proxy issue.

---

<div class="post-metadata">

### Author: ![rseddon](https://yyz1.discourse-cdn.com/flex047/user_avatar/community.sonatype.com/rseddon/32/341_2.png) [@rseddon](https://community.sonatype.com/u/rseddon)
#### Post date: [February 3, 2021, 9:58pm UTC](https://community.sonatype.com/t/restricting-ananymous-user-from-seeing-system-information/5818/7 "2021-02-03T21:58:30Z")

</div>

Has the security realm of the anonymous user been changed under “security → anonymous”? It should be the “local authorizing realm”. Also make sure the anonymous user name is set to “anonymous”.