Getting Data In

How to disable Splunk Web on a universal forwarder?

andylee53
New Member

I use Nessus to scan for SSL issues, and the Splunk Web interface is being flagged due to the self signed certs. I have managed to make my indexer / search head use internally MS CA certs and go the cert chain sorted for the login screen to Splunk Web. My question is, do I use a similar process for the forwarders, or can I shut down the web interface on the Universal forwarder? If so, how? If not, how do I change the certs on the UF?

0 Karma
1 Solution

aosso
Path Finder

If the Nessus detection is on port 8089, you can shut it down by adding this to UF's server.conf:

[httpServer]
disableDefaultPort = true

View solution in original post

aosso
Path Finder

If the Nessus detection is on port 8089, you can shut it down by adding this to UF's server.conf:

[httpServer]
disableDefaultPort = true

dwaddle
SplunkTrust
SplunkTrust

Note: This is NOT disabling SplunkWeb. A UF does not have SplunkWeb ever at all, period. This is disabling the REST API server. This has side effects on the UF, such that the CLI largely (but not completely) quite working. See Matt's .conf talk:

http://conf.splunk.com/files/2016/recordings/universal-forwarder-security-dont-input-more-than-data-...
http://conf.splunk.com/files/2016/slides/universal-forwarder-security-dont-input-more-than-data-into...

Get Updates on the Splunk Community!

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL  The Splunk AI Assistant for SPL ...

Buttercup Games: Further Dashboarding Techniques (Part 5)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Customers Increasingly Choose Splunk for Observability

For the second year in a row, Splunk was recognized as a Leader in the 2024 Gartner® Magic Quadrant™ for ...