diff --git a/tunnel-server/src/main/java/com/alibaba/arthas/tunnel/server/endpoint/ActuatorSecurity.java b/tunnel-server/src/main/java/com/alibaba/arthas/tunnel/server/endpoint/ActuatorSecurity.java
new file mode 100644
index 000000000..f35b5f857
--- /dev/null
+++ b/tunnel-server/src/main/java/com/alibaba/arthas/tunnel/server/endpoint/ActuatorSecurity.java
@@ -0,0 +1,15 @@
+package com.alibaba.arthas.tunnel.server.endpoint;
+
+import org.springframework.boot.actuate.autoconfigure.security.servlet.EndpointRequest;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+
+@Configuration
+public class ActuatorSecurity extends WebSecurityConfigurerAdapter {
+    @Override
+    protected void configure(HttpSecurity httpSecurity) throws Exception {
+        httpSecurity.authorizeRequests().requestMatchers(EndpointRequest.toAnyEndpoint()).authenticated().anyRequest()
+                .permitAll().and().formLogin();
+    }
+}
\ No newline at end of file