will server hardening (CIS redhat 9 level 1) break Splunk functionality?

[tdth]

Hi

I have splunk servers (full deployment with index cluster, sh cluster) running on redhat 9.

Now we want to harden the server following cis standard. Will this have any impact on Splunk application? Any exception need to be made? 

Thanks

[kiran_panchavat]

@tdth 

Yes, implementing CIS benchmarks to harden your Red Hat 9 servers can potentially impact your Splunk deployment if not carefully managed. What specific hardening measures are you planning to apply? It's best to first implement CIS hardening in a UAT environment and thoroughly test its impact before deploying it in production.

[tdth]

Thanks, I guess we have no choice but to test it out.

In your experience, what could be the impact to Splunk application?

[richgalloway]

What specifically do you plan to do to harden the server?  Once we know that, we can tell what effect it will have.

[tdth]

As I mentioned, we want to harden the Linux server following CIS benchmark. There is long list of things to be done so it's hard to put down everything here... The goal is to make the server and the application more secured

[richgalloway]

There is a long list of things that potentially could go wrong depending on what you do to the server to harden it.  It's hard to be specific about the results if you can't be specific about the changes.  We're all volunteers here, so try to meet us halfway.