Getting Data In

How to change universal forwarder default password in port 8089?

Yadukrishnan
Explorer

Hi,

My Splunk Enterprise security is hosted in Linux servers and the Splunk UF is deployed to both Linux and Windows Operating Systems. Recently Qualys has reported a Vulnerability on the Splunk servers that the UF is listening through port 8089 and is accessible using default password. Can some one help me how to change this default password with out individually log into these large number of end points. Is there any way to centrally do this from Splunk servers. 

Labels (2)
Tags (1)
0 Karma
1 Solution

batabay
Path Finder

Hi,

Actually there is no reason for uf's listen 8089 port.

So you can close listening port with deployment server.

Please create new app in deployment-apps , for example all_uf_base.

In the local folder put this configuration.

local/server.conf

[httpServer]
disableDefaultPort = true

 

Send this app to all_universalforwarder, please be careful and spesific sending this app and don't forget blacklist your heavyforwarders if managening from deployment server.

So UF's will not listening 8089 port.

View solution in original post

Tags (1)

Yadukrishnan
Explorer

Thanks much. That actually worked. I disabled the port 8089 and deployed it from Deployment server. But there are still some servers for which this disabling from deployment server didnt work. Any idea what might be the issue. 

0 Karma

batabay
Path Finder

Hi,

Actually there is no reason for uf's listen 8089 port.

So you can close listening port with deployment server.

Please create new app in deployment-apps , for example all_uf_base.

In the local folder put this configuration.

local/server.conf

[httpServer]
disableDefaultPort = true

 

Send this app to all_universalforwarder, please be careful and spesific sending this app and don't forget blacklist your heavyforwarders if managening from deployment server.

So UF's will not listening 8089 port.

Tags (1)
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...