topic How to change universal forwarder default password in port 8089? in Getting Data In

How to change universal forwarder default password in port 8089?

Yadukrishnan — Thu, 02 Feb 2023 14:31:24 GMT

Hi,

My Splunk Enterprise security is hosted in Linux servers and the Splunk UF is deployed to both Linux and Windows Operating Systems. Recently Qualys has reported a Vulnerability on the Splunk servers that the UF is listening through port 8089 and is accessible using default password. Can some one help me how to change this default password with out individually log into these large number of end points. Is there any way to centrally do this from Splunk servers.

Re: Change Universal Forwarder default password in port 8089

batabay — Tue, 31 Jan 2023 09:43:36 GMT

Hi,

Actually there is no reason for uf's listen 8089 port.

So you can close listening port with deployment server.

Please create new app in deployment-apps , for example all_uf_base.

In the local folder put this configuration.

local/server.conf

[httpServer] disableDefaultPort = true

Send this app to all_universalforwarder, please be careful and spesific sending this app and don't forget blacklist your heavyforwarders if managening from deployment server.

So UF's will not listening 8089 port.

Re: Change Universal Forwarder default password in port 8089?

Yadukrishnan — Thu, 02 Feb 2023 07:40:32 GMT

Thanks much. That actually worked. I disabled the port 8089 and deployed it from Deployment server. But there are still some servers for which this disabling from deployment server didnt work. Any idea what might be the issue.