topic Re: Splunk Certificate 8089 Port in Splunk Enterprise

Splunk Certificate 8089 Port

edgarsilva01 — Fri, 10 Jul 2020 22:11:27 GMT

Hello

I'm trying to install a web certificate for port 8089, I don't know what I'm doing wrong.
There are already 3 scans and the vulnerability continues to appear.

Someone who has already solved it

This is the stanza I have in the web.conf file

[settings]
enableSplunkWebSSL = true
privKeyPath = /opt/splunk/etc/auth/mycerts/certificate.key
serverCert = /opt/splunk/etc/auth/mycerts/certificate.pem

Re: Splunk Certificate 8089 Port

richgalloway — Sat, 11 Jul 2020 00:27:10 GMT

What problem are you trying to solve?
What "vulnerability" are you talking about?
Port 8089 is not "SplunkWeb". It's the Splunk management port used by Splunk instances to talk to each other. Change the security on that post and you could break your Splunk installation.
"SplunkWeb" is port 8000.

Re: Splunk Certificate 8089 Port

edgarsilva01 — Sat, 11 Jul 2020 04:53:52 GMT

Hi richgalloway

The problem I have is that a scan was performed to one of the servers where a universal forwarder is installed and a vulnerability in port 8089 of the splunk service was detected.

To solve this problem, a digital certificate was requested, upload it to the deployment server, in a second scan the vulnerability is still active

Re: Splunk Certificate 8089 Port

richgalloway — Sat, 11 Jul 2020 12:39:48 GMT

You don't say what vulnerability was reported, but perhaps this answer will solve your problem: https://community.splunk.com/t5/Security/Splunk-Enterprise-8089-Vulnerability-Scan-Results-Resolve-these/td-p/493478
It's not enough to put a certificate on the DS - it must be installed on the UF to protect the UF's management port.