topic Re: Using apache ssl reverse proxy in front of splunk web 6.2.1? in Security

Using apache ssl reverse proxy in front of splunk web 6.2.1?

huntd — Wed, 25 Feb 2015 23:24:03 GMT

So I have a config where I have a few web services running on the same machine, and I use httpd listening on 443 to distribute the requests. Httpd handles the SSL connection to/from the client, and uses regular http to talk to the locally-running services over lo.

I've also read every post I can find on this issue, and none of them have helped fix this.

Specifically, when I hit a splunk URL that generates a redirect, splunk attempts to redirect the browser using a document.location statement in the page itself:

document.location = "http://myserver.xyz/splunk/en-US/" + hashTag;\n

where "myserver.xyz" is actually the correct FQDN. This fails b/c nothing is listening for http externally.

If I hit a splunk URL that doesn't generate a redirect, I get the page I was expecting.

Based on what I've read, here's my web.conf for splunk:

[settings] enableSplunkWebSSL = 0 httpport = 8800 root_endpoint = /splunk tools.proxy.base = https://myserver.xyz

And my httpd config:

SSLProxyEngine On ProxyRequests Off ProxyPreserveHost On ProxyPass /splunk http://internal:8800/splunk ProxyPassReverse /splunk http://internal:8800/splunk Location /splunk> Order allow,deny Allow from all /Location>

where "internal" is the local machine hostname; and the Location block uses proper syntax (wikimarkup is breaking the opening '<' along with the newlines; the preview works fine, so what is that about?!?).

Based on everything I've read, this should work. So why does splunk still issue redirects back to the http:// URL?

Re: Using apache ssl reverse proxy in front of splunk web 6.2.1?

pduflot — Thu, 02 Jul 2015 15:36:27 GMT

I have the same problem here. Did you find how to make it work? Does anybody have an answer?

Re: Using apache ssl reverse proxy in front of splunk web 6.2.1?

phwinkler — Sat, 10 Oct 2015 19:14:38 GMT

This is working for me (enable SSL for splunk and use ProxyPass with https):

Apache Config (using https):

ProxyPass           https://123.123.123.123:8000/splunk retry=60 timeout=300 ttl=600 flushwait=600
ProxyPassReverse    https://123.123.123.123:8000/splunk

Splunks web.conf:

enableSplunkWebSSL = 1

privKeyPath = etc/auth/splunkweb/privkey.pem
caCertPath = etc/auth/splunkweb/cert.pem

supportSSLV3Only = False

I'd rather not have to encrypt/decrypt everything twice but at least it works..

Re: Using apache ssl reverse proxy in front of splunk web 6.2.1?

rafamss — Fri, 22 Jul 2016 20:06:19 GMT

Worked fine to me!