topic Re: What is the security measures that i should take when introducing universal forwarder on a production environment? in Getting Data In

What is the security measures that i should take when introducing universal forwarder on a production environment?

royimad — Wed, 20 Mar 2013 09:19:36 GMT

Hello Splunkies,

I need to know what are the security measures that is should take if i want to introduce universal forwarder on a production environment to forward data to splunk instance on another machine.

Thanks,
Roy

Re: What is the security measures that i should take when introducing universal forwarder on a production environment?

kristian_kolb — Wed, 20 Mar 2013 16:45:49 GMT

You may want to encrypt the log traffic with proper SSL-keys, and not the ones that come by default.

Change the splunk password from 'changeme' into something else.

You might consider Forwarder Acknoledgement, to ensure that data gets written to index.

http://docs.splunk.com/Documentation/Splunk/latest/Security/WhatyoucansecurewithSplunk

Re: What is the security measures that i should take when introducing universal forwarder on a production environment?

dshpritz — Wed, 20 Mar 2013 17:27:25 GMT

Also, if possible, change the user that Splunk runs as:

http://docs.splunk.com/Documentation/Splunk/5.0.2/installation/RunSplunkasadifferentornon-rootuser

Re: What is the security measures that i should take when introducing universal forwarder on a production environment?

Drainy — Wed, 20 Mar 2013 17:43:41 GMT

Its worth adding that if you install Splunk via the rpm on linux it will handle this for you