topic Re: How to disable methods from the https://localhost:8000 ? in Splunk Search

How to disable methods from the https://localhost:8000 ?

sangsun0203 — Sun, 27 Jan 2019 16:49:41 GMT

When I make
curl -v -X https://127.0.0.1:8000

It returns
Accept: all or any(/) it seems like all methods are working. It means that GET, POST, HEAD, OPTIONS are working.

But, I want make only working on get, post. Because, security reasons.
How could I make it?

Re: How to disable methods from the https://localhost:8000 ?

chrisyounger — Sun, 27 Jan 2019 19:02:55 GMT

You can't change it.

If this is really important to you, then put an NGINX or other type of reverse proxy in front of Splunk. Splunk on port 8000 uses all these verbs becuase it is also a REST service on some paths.

As far as security risks go, web servers that accept the extra verbs is an info-level risk in my opinion.

See also this post for a similar question about universal forwarders: https://answers.splunk.com/answers/715424/a-vulnerability-scan-revealed-that-http-options-me.html?childToView=715426#answer-715426

Re: How to disable methods from the https://localhost:8000 ?

sangsun0203 — Mon, 28 Jan 2019 08:39:24 GMT

Thanks for your help! I spend whole my weekend for limitation of methods.

Re: How to disable methods from the https://localhost:8000 ?

chrisyounger — Mon, 28 Jan 2019 09:20:20 GMT

happy I could be of help 🙂