topic Re: PYTHONHTTPSVERIFY in Installation

PYTHONHTTPSVERIFY

yohhpark — Fri, 07 Jul 2023 13:32:12 GMT

hi Expert Splunkers,

really appriciate if you take a look at bottom.

splunkforwarder running on UBUNTU

Warning: Attempting to revert the SPLUNK_HOME ownership
Warning: Executing "chown -R root /opt/splunkforwarder"

Splunk> Now with more code!

Checking prerequisites...
Management port has been set disabled; cli support for this configuratio n is currently incomplete.
Checking conf files for problems...
Invalid key in stanza [webhook] in /opt/splunkforwarder/etc/syst em/default/alert_actions.conf, line 229: enable_allowlist (value: false).
Your indexes and inputs configurations are not internally consis tent. For more information, run 'splunk btool check --debug'
Done
Checking default conf files for edits...
Validating installed files against hashes from '/opt/splunkforwarder/spl unkforwarder-9.0.5-e9494146ae5c-linux-2.6-x86_64-manifest'
All installed files intact.
Done
All preliminary checks passed.

Starting splunk server daemon (splunkd)...
PYTHONHTTPSVERIFY is set to 0 in splunk-launch.conf disabling certificate valida tion for the httplib and urllib libraries shipped with the embedded Python inter preter; must be set to "1" for increased security
Done

1. installed splunk with root user

2. keep on getting that lines at the end start with PYTHONHTTPSVERIFY (first time seeing it)

3. inputs issue can be ignored.

Re: PYTHONHTTPSVERIFY

richgalloway — Fri, 07 Jul 2023 14:49:57 GMT

1. Running Splunk as root is not advised for security reasons.

2. The PYTHONHTTPSVERIFY warning can be ignored if you're willing to accept the risk. See https://docs.splunk.com/Documentation/Splunk/9.0.5/Security/EnableTLSCertHostnameValidation#Configure_TLS_host_name_validation_for_Splunk_Python_modules for more information. There is a known issue with enabling this feature so you may want to leave it off for now. See https://docs.splunk.com/Documentation/Splunk/9.1.0/ReleaseNotes/Knownissues#Authentication_and_authorization_issues

3. What is the "inputs issue"?

Btool is reporting an invalid setting in alert_actions.conf. Verify the "enable_allowlist" setting is correct.

Re: PYTHONHTTPSVERIFY

yohhpark — Fri, 07 Jul 2023 15:04:45 GMT

thank you helps a lot!

but 1. how can I undo the running on root?

what would be the recommendation?

2. thank you for clarifying those

3. I understand this issue, cthis one can be ignore from our end.

thank you

Re: PYTHONHTTPSVERIFY

richgalloway — Fri, 07 Jul 2023 15:27:37 GMT

To change Splunk to run as user 'splunk' follow these steps.

1) Stop Splunk

2) Edit the init.d or splunk.service file to set the user to be 'splunk'

For init.d, use command like these:

USER=splunk ... splunk_start() { echo Starting Splunk... su - ${USER} -c '"/opt/splunk/bin/splunk" start --no-prompt --answer-yes' RETVAL=$? [ $RETVAL -eq 0 ] && touch /var/lock/subsys/splunk }

3) Change the ownership of all files in $SPLUNK_HOME to 'splunk'

chown -r splunk:splunk /opt/splunk

4) Start Splunk