https://community.splunk.com/t5/Getting-Data-In/How-to-disable-Splunk-Web-on-a-universal-forwarder/m-p/282472#M53986 <P>I use Nessus to scan for SSL issues, and the Splunk Web interface is being flagged due to the self signed certs. I have managed to make my indexer / search head use internally MS CA certs and go the cert chain sorted for the login screen to Splunk Web. My question is, do I use a similar process for the forwarders, or can I shut down the web interface on the Universal forwarder? If so, how? If not, how do I change the certs on the UF?</P> Thu, 27 Oct 2016 10:26:31 GMT andylee53 2016-10-27T10:26:31Z https://community.splunk.com/t5/Getting-Data-In/How-to-disable-Splunk-Web-on-a-universal-forwarder/m-p/282472#M53986 <P>I use Nessus to scan for SSL issues, and the Splunk Web interface is being flagged due to the self signed certs. I have managed to make my indexer / search head use internally MS CA certs and go the cert chain sorted for the login screen to Splunk Web. My question is, do I use a similar process for the forwarders, or can I shut down the web interface on the Universal forwarder? If so, how? If not, how do I change the certs on the UF?</P> Thu, 27 Oct 2016 10:26:31 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-disable-Splunk-Web-on-a-universal-forwarder/m-p/282472#M53986 andylee53 2016-10-27T10:26:31Z https://community.splunk.com/t5/Getting-Data-In/How-to-disable-Splunk-Web-on-a-universal-forwarder/m-p/282473#M53987 <P>If the Nessus detection is on port 8089, you can shut it down by adding this to UF's server.conf:</P> <PRE><CODE>[httpServer] disableDefaultPort = true </CODE></PRE> Thu, 27 Oct 2016 10:52:49 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-disable-Splunk-Web-on-a-universal-forwarder/m-p/282473#M53987 aosso 2016-10-27T10:52:49Z https://community.splunk.com/t5/Getting-Data-In/How-to-disable-Splunk-Web-on-a-universal-forwarder/m-p/282474#M53988 <P>Note: This is NOT disabling SplunkWeb. A UF does not have SplunkWeb ever at all, period. This is disabling the REST API server. This has side effects on the UF, such that the CLI largely (but not completely) quite working. See Matt's .conf talk:</P> <P><A href="http://conf.splunk.com/files/2016/recordings/universal-forwarder-security-dont-input-more-than-data-into-your-splunk-environment.mp4">http://conf.splunk.com/files/2016/recordings/universal-forwarder-security-dont-input-more-than-data-into-your-splunk-environment.mp4</A><BR /> <A href="http://conf.splunk.com/files/2016/slides/universal-forwarder-security-dont-input-more-than-data-into-your-splunk-environment.pdf">http://conf.splunk.com/files/2016/slides/universal-forwarder-security-dont-input-more-than-data-into-your-splunk-environment.pdf</A></P> Fri, 28 Oct 2016 04:51:07 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-disable-Splunk-Web-on-a-universal-forwarder/m-p/282474#M53988 dwaddle 2016-10-28T04:51:07Z