Getting Data In

How to change universal forwarder default password in port 8089?

Yadukrishnan
Explorer

Hi,

My Splunk Enterprise security is hosted in Linux servers and the Splunk UF is deployed to both Linux and Windows Operating Systems. Recently Qualys has reported a Vulnerability on the Splunk servers that the UF is listening through port 8089 and is accessible using default password. Can some one help me how to change this default password with out individually log into these large number of end points. Is there any way to centrally do this from Splunk servers. 

Labels (2)
Tags (1)
0 Karma
1 Solution

batabay
Path Finder

Hi,

Actually there is no reason for uf's listen 8089 port.

So you can close listening port with deployment server.

Please create new app in deployment-apps , for example all_uf_base.

In the local folder put this configuration.

local/server.conf

[httpServer]
disableDefaultPort = true

 

Send this app to all_universalforwarder, please be careful and spesific sending this app and don't forget blacklist your heavyforwarders if managening from deployment server.

So UF's will not listening 8089 port.

View solution in original post

Tags (1)

Yadukrishnan
Explorer

Thanks much. That actually worked. I disabled the port 8089 and deployed it from Deployment server. But there are still some servers for which this disabling from deployment server didnt work. Any idea what might be the issue. 

0 Karma

batabay
Path Finder

Hi,

Actually there is no reason for uf's listen 8089 port.

So you can close listening port with deployment server.

Please create new app in deployment-apps , for example all_uf_base.

In the local folder put this configuration.

local/server.conf

[httpServer]
disableDefaultPort = true

 

Send this app to all_universalforwarder, please be careful and spesific sending this app and don't forget blacklist your heavyforwarders if managening from deployment server.

So UF's will not listening 8089 port.

Tags (1)
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

Industry Solutions for Supply Chain and OT, Amazon Use Cases, Plus More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...