All Apps and Add-ons

Splunk Mobile Access Server: Is it possible to restrict access to only allow IOS application connections?

Alteek
Explorer

Hi,

I have been reading the documentation and whereas this server is aimed to be accessed from the internet, I didn't find procedures to restrict the access.
Is that possible to do so in order to only allow the IOS applications connections (API only and no human connection in the Administration page, etc..).

Thank you for your help,
Regards

0 Karma
1 Solution

jzhong_splunk
Splunk Employee
Splunk Employee

Hi Alteek,

The mobile access server REST API only accepts connections from iOS app, by checking a special HTTP header key/value. You can even change the default value so that only trusted devices can connect to the mobile server. If your organization uses any EMM(Enterprise Mobile Management) or MAM/MDM (Mobile Device or Application Management) tools, say Good/MobileIron/AirWatch/etc, they have a more sophisticated solution to control/protect this.

The administration console, however is opened to any browser. Anyone with valid admin account can access to it. To prevent someone tries to guess your admin password, the mobile serve has a built-in feature to lock the admin account if there are 3 or more failure login attempts.

If you would like to limit the access of administration console to trusted IP or range, I would suggest you deploying a proxy server like apache or nginx. The mobile server itself doesn't provide such common HTTP feature. You can use apache/nginx or control your firewall to only allow certain IP/range to access the mobile access server.

Hope it helps.

Jove Z. 
Sr Manager, Software Engineering 
Splunk Mobile Access

View solution in original post

jzhong_splunk
Splunk Employee
Splunk Employee

Hi Alteek,

The mobile access server REST API only accepts connections from iOS app, by checking a special HTTP header key/value. You can even change the default value so that only trusted devices can connect to the mobile server. If your organization uses any EMM(Enterprise Mobile Management) or MAM/MDM (Mobile Device or Application Management) tools, say Good/MobileIron/AirWatch/etc, they have a more sophisticated solution to control/protect this.

The administration console, however is opened to any browser. Anyone with valid admin account can access to it. To prevent someone tries to guess your admin password, the mobile serve has a built-in feature to lock the admin account if there are 3 or more failure login attempts.

If you would like to limit the access of administration console to trusted IP or range, I would suggest you deploying a proxy server like apache or nginx. The mobile server itself doesn't provide such common HTTP feature. You can use apache/nginx or control your firewall to only allow certain IP/range to access the mobile access server.

Hope it helps.

Jove Z. 
Sr Manager, Software Engineering 
Splunk Mobile Access

Alteek
Explorer

Thank you, this make sense.
I'll have a look at the account lockout possibilities:

"account_lock_out": {
"max_attempts": 3,
"reset_interval": 10800,
"lock_duration": 60,
"attempts_expiration": 7776000

And have a look to nginx.

Regards

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...