Deployment Architecture

In need of Splunk Web configuration guidance- Is it possible to set up access depending on physical access?



I hope to get some guidance regarding configuring a Splunk web interface to be public facing while keeping the management side on a private interface. Some of the information I have read from our esteemed experts is a bit confusing to me. I am tracking that I am able to make changes to the web.conf file to alter the default IP/interface but there is a caution that i should also change the management side with that. 

For security reasons and separation of duties, I am hoping to set it up that only persons who have physical access to the private network can make managerial changes but allow access to the web interface for analysts outside the immediate area to use the SEIM. I

Is this even possible or am I seeking to set something up that is largely moot? 



Labels (1)
0 Karma

Esteemed Legend

Hi @mmichel,

if you're speaking of Splunk configurations, you can only define different roles (assigned to the users): some roles have enabled administrative functions that are disabled for the other soles, then the data access (without configuration changing) are enabled for all users, or eventualy segmented for different user roles (e.g. developers can access some indexes that are closed for help desk people).

In other words, it isn't possible to have two different interfaces for the two roles.

If you want also a physical separation, you could use two different Search Heads: one for normal users and both for administration but it isn't a good idea because you have a Search Head less used.

It's different if you're speaking of network access rules to the Splunk web interface, that you can segregate by firewall rules (having two Search Heads).



Get Updates on the Splunk Community!

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...