In need of Splunk Web configuration guidance- Is it possible to set up access depending on physical access?

[mmichel]

Hello, 

I hope to get some guidance regarding configuring a Splunk web interface to be public facing while keeping the management side on a private interface. Some of the information I have read from our esteemed experts is a bit confusing to me. I am tracking that I am able to make changes to the web.conf file to alter the default IP/interface but there is a caution that i should also change the management side with that. 

For security reasons and separation of duties, I am hoping to set it up that only persons who have physical access to the private network can make managerial changes but allow access to the web interface for analysts outside the immediate area to use the SEIM. I

Is this even possible or am I seeking to set something up that is largely moot? 

v/r

Matt

[gcusello]

Hi @mmichel,

if you're speaking of Splunk configurations, you can only define different roles (assigned to the users): some roles have enabled administrative functions that are disabled for the other soles, then the data access (without configuration changing) are enabled for all users, or eventualy segmented for different user roles (e.g. developers can access some indexes that are closed for help desk people).

In other words, it isn't possible to have two different interfaces for the two roles.

If you want also a physical separation, you could use two different Search Heads: one for normal users and both for administration but it isn't a good idea because you have a Search Head less used.

It's different if you're speaking of network access rules to the Splunk web interface, that you can segregate by firewall rules (having two Search Heads).

Ciao.

Giuseppe