topic Re: How to limit mgmt port access to localhost only on Universal Forwarder or Heavy Forwarder in Getting Data In

How to limit mgmt port access to localhost only on Universal Forwarder or Heavy Forwarder

cwacha — Wed, 09 May 2012 14:41:31 GMT

For security reasons we would like to disable the management port but unfortunately very neat debugging commands such as

./bin/splunk list monitor

stop working after that. It would be ok if we have the port enabled but accessible only for localhost communication. Altough the configuration explicitly sets the localhost IP address it is still possible to open telnet connections from other ports.

web.conf
[settings]
mgmtHostPort = 127.0.0.1:8089

Even netstat shows that the port is open on every available network interface.

# netstat -an | grep 8089
tcp        0      0 0.0.0.0:8089                0.0.0.0:*                   LISTEN

Question: how can we force the Universal Forwarder (or even the Heavy Forwarder) to bind to the localhost interface only?

Re: How to limit mgmt port access to localhost only on Universal Forwarder or Heavy Forwarder

mikelanghorst — Mon, 28 Sep 2020 11:47:34 GMT

http://docs.splunk.com/Documentation/Splunk/4.3.2/Admin/BindSplunktoanIP

You should be able to set SPLUNK_BINDIP=127.0.0.1 in $splunk_home/etc/splunk-launch.conf so it will only bind to localhost.

Re: How to limit mgmt port access to localhost only on Universal Forwarder or Heavy Forwarder

cwacha — Wed, 09 May 2012 19:54:18 GMT

Great! This did the trick. Thanks!

Re: How to limit mgmt port access to localhost only on Universal Forwarder or Heavy Forwarder

redoracle — Sun, 16 Feb 2014 15:02:00 GMT

Yes, but then you have have everything bonded to that IP...

what about if I want the http listener and the management only listening on localhost, and splunk syslog and forwarder ports listening on 0.0.0.0 or a specific IP???

Re: How to limit mgmt port access to localhost only on Universal Forwarder or Heavy Forwarder

bricker — Wed, 01 Jul 2015 21:38:18 GMT

We also would like the mgmt port to listen only on localhost as well. The port on the IP is being picked up app scans and coming up with SSL vulnerabilities so it would be best to not have it on the network on every host.

Has anyone been able to get it to bind only to 127.0.0.1?

Re: How to limit mgmt port access to localhost only on Universal Forwarder or Heavy Forwarder

jespencer_splun — Tue, 15 Nov 2016 03:20:40 GMT

I think your best bet is to bind locally via splunk-launch.conf then use iptables (DNAT) or xinetd (redirect) to forward inbound requests to the ports you wish to expose.

That's more of a security first answer than the alternative of locking down the other ports Splunk listens to at 0.0.0.0.

Ask your SE to submit a feature enhancement request for binding address on a per listener basis if that's important to your specific use case.