topic Re: Splunk Web not accessible via https in Security

Splunk Web not accessible via https

abhijitnath89ax — Sun, 07 Jun 2020 17:38:24 GMT

We had provided created certificates and provided all information in web.conf
[settings]
enableSplunkWebSSL = 1
privKeyPath = /opt/splunk/etc/auth/mycerts/CertAwsDev/private.key
serverCert = /opt/splunk/etc/auth/mycerts/CertAwsDev/Cert.pem
httpport = 443

But we are not getting the 443v port established in the server
netstat -aen | grep 443

For this reason it is coming unhealthy (502) in AWS target groups

Re: Splunk Web not accessible via https

PavelP — Wed, 22 Apr 2020 07:48:54 GMT

Does the splunkd process listen on port 443? You haven't provided the output of netstat command.

If splunkd is listening on the port then check firewall (network and local).

Let me know how it went

Re: Splunk Web not accessible via https

harsmarvania57 — Wed, 22 Apr 2020 08:18:53 GMT

Are you running splunk with root user ? On Linux only root can use port < 1024.

Re: Splunk Web not accessible via https

abhijitnath89ax — Wed, 22 Apr 2020 08:50:17 GMT

I am running splunk with root user

Re: Splunk Web not accessible via https

abhijitnath89ax — Wed, 22 Apr 2020 08:52:57 GMT

Below is the output of netstat command

netstat -aen | grep 443
tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 0 9944802
tcp 0 0 10.x.x.101:37272 54.x.x.173:443 ESTABLISHED 0 10220872
tcp 0 0 10.x.x.101:59914 54.x.x.213:443 TIME_WAIT 0 0
tcp 0 0 10.x.x.101:46116 52.x.x.97:443 ESTABLISHED 0 10220742

Re: Splunk Web not accessible via https

harsmarvania57 — Wed, 22 Apr 2020 09:01:48 GMT

Please provide output of ss -nltp | grep 443

Re: Splunk Web not accessible via https

harsmarvania57 — Wed, 22 Apr 2020 09:42:27 GMT

Based on output provided by you, your server is listening on port 443 but AWS LB is getting 502 Bad gateway in health check. As I don't have more knowledge on AWS side, I can't help much more but if you are using self signed certificate on splunk server then you might need to add root certificate on AWS LB.

Re: Splunk Web not accessible via https

abhijitnath89ax — Wed, 22 Apr 2020 10:06:58 GMT

LISTEN 0 128 0.0.0.0:443 0.0.0.0:* users:(("splunkd",pid=20841,fd=112))