Getting Data In

How to change universal forwarder default password in port 8089?

Yadukrishnan
Explorer

Hi,

My Splunk Enterprise security is hosted in Linux servers and the Splunk UF is deployed to both Linux and Windows Operating Systems. Recently Qualys has reported a Vulnerability on the Splunk servers that the UF is listening through port 8089 and is accessible using default password. Can some one help me how to change this default password with out individually log into these large number of end points. Is there any way to centrally do this from Splunk servers. 

Labels (2)
Tags (1)
0 Karma
1 Solution

batabay
Path Finder

Hi,

Actually there is no reason for uf's listen 8089 port.

So you can close listening port with deployment server.

Please create new app in deployment-apps , for example all_uf_base.

In the local folder put this configuration.

local/server.conf

[httpServer]
disableDefaultPort = true

 

Send this app to all_universalforwarder, please be careful and spesific sending this app and don't forget blacklist your heavyforwarders if managening from deployment server.

So UF's will not listening 8089 port.

View solution in original post

Tags (1)

Yadukrishnan
Explorer

Thanks much. That actually worked. I disabled the port 8089 and deployed it from Deployment server. But there are still some servers for which this disabling from deployment server didnt work. Any idea what might be the issue. 

0 Karma

batabay
Path Finder

Hi,

Actually there is no reason for uf's listen 8089 port.

So you can close listening port with deployment server.

Please create new app in deployment-apps , for example all_uf_base.

In the local folder put this configuration.

local/server.conf

[httpServer]
disableDefaultPort = true

 

Send this app to all_universalforwarder, please be careful and spesific sending this app and don't forget blacklist your heavyforwarders if managening from deployment server.

So UF's will not listening 8089 port.

Tags (1)
Get Updates on the Splunk Community!

Tips & Tricks When Using Ingest Actions

Tune in to learn about:Large scale architecture when using Ingest ActionsRegEx performance considerations ...

Announcing Our Splunk MVPs

We are excited to announce the first cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...