topic Can I disable the Management Port 8089 in a Light Forwarder? in Security

Can I disable the Management Port 8089 in a Light Forwarder?

mzorzi — Tue, 11 May 2010 18:06:13 GMT

Due to internal secure policies the mgmPort must be disabled: I don't want anything to be able to talk through any port of my Light Forwarder, instead I want it to be an output-only box.

In term of security, if you don't use a component, always better to disable it.

Is it possible to suppress this functionality?

Re: Can I disable the Management Port 8089 in a Light Forwarder?

mzorzi — Tue, 11 May 2010 20:31:43 GMT

In the file:
$SPLUNK_HOME/etc/system/local/server.conf

add the entry:

[httpServer]
disableDefaultPort = true

Then restart Splunk.

Re: Can I disable the Management Port 8089 in a Light Forwarder?

drrushi_splunk — Fri, 21 Dec 2012 22:16:24 GMT

In addition once you set 'disableDefaultPort=true' you will notice that upon start/restart Splunk will still check on the availability of the management port. This does NOT mean that it will use the port eventually.

Note: You will not be able to run successfully CLI admin commands as they retrieve information from Splunk's endpoint using the management port.

Re: Can I disable the Management Port 8089 in a Light Forwarder?

dwalgamotte — Fri, 06 Nov 2015 23:15:04 GMT

can forwarders still receive updates from the deployment server if the daemon is off?

Re: Can I disable the Management Port 8089 in a Light Forwarder?

yarick — Wed, 14 Nov 2018 16:24:15 GMT

Yes, because it is a pull-type of connection.