Splunk Mobile Access Server: Is it possible to restrict access to only allow IOS application connections?

[Alteek]

Hi,

I have been reading the documentation and whereas this server is aimed to be accessed from the internet, I didn't find procedures to restrict the access.
Is that possible to do so in order to only allow the IOS applications connections (API only and no human connection in the Administration page, etc..).

Thank you for your help,
Regards

[jzhong_splunk · Accepted solution]

Hi Alteek,

The mobile access server REST API only accepts connections from iOS app, by checking a special HTTP header key/value. You can even change the default value so that only trusted devices can connect to the mobile server. If your organization uses any EMM(Enterprise Mobile Management) or MAM/MDM (Mobile Device or Application Management) tools, say Good/MobileIron/AirWatch/etc, they have a more sophisticated solution to control/protect this.

The administration console, however is opened to any browser. Anyone with valid admin account can access to it. To prevent someone tries to guess your admin password, the mobile serve has a built-in feature to lock the admin account if there are 3 or more failure login attempts.

If you would like to limit the access of administration console to trusted IP or range, I would suggest you deploying a proxy server like apache or nginx. The mobile server itself doesn't provide such common HTTP feature. You can use apache/nginx or control your firewall to only allow certain IP/range to access the mobile access server.

Hope it helps.

Jove Z. 
Sr Manager, Software Engineering 
Splunk Mobile Access

[Alteek]

Thank you, this make sense.
I'll have a look at the account lockout possibilities:

"account_lock_out": {
"max_attempts": 3,
"reset_interval": 10800,
"lock_duration": 60,
"attempts_expiration": 7776000

And have a look to nginx.

Regards