Getting Data In

How to limit mgmt port access to localhost only on Universal Forwarder or Heavy Forwarder

cwacha
Path Finder

For security reasons we would like to disable the management port but unfortunately very neat debugging commands such as

./bin/splunk list monitor

stop working after that. It would be ok if we have the port enabled but accessible only for localhost communication. Altough the configuration explicitly sets the localhost IP address it is still possible to open telnet connections from other ports.

web.conf
[settings]
mgmtHostPort = 127.0.0.1:8089

Even netstat shows that the port is open on every available network interface.

# netstat -an | grep 8089
tcp        0      0 0.0.0.0:8089                0.0.0.0:*                   LISTEN      

Question: how can we force the Universal Forwarder (or even the Heavy Forwarder) to bind to the localhost interface only?

0 Karma
1 Solution

mikelanghorst
Motivator

http://docs.splunk.com/Documentation/Splunk/4.3.2/Admin/BindSplunktoanIP

You should be able to set SPLUNK_BINDIP=127.0.0.1 in $splunk_home/etc/splunk-launch.conf so it will only bind to localhost.

View solution in original post

jespencer_splun
Splunk Employee
Splunk Employee

I think your best bet is to bind locally via splunk-launch.conf then use iptables (DNAT) or xinetd (redirect) to forward inbound requests to the ports you wish to expose.

That's more of a security first answer than the alternative of locking down the other ports Splunk listens to at 0.0.0.0.

Ask your SE to submit a feature enhancement request for binding address on a per listener basis if that's important to your specific use case.

0 Karma

bricker
Engager

We also would like the mgmt port to listen only on localhost as well. The port on the IP is being picked up app scans and coming up with SSL vulnerabilities so it would be best to not have it on the network on every host.

Has anyone been able to get it to bind only to 127.0.0.1?

0 Karma

redoracle
Engager

Yes, but then you have have everything bonded to that IP...

what about if I want the http listener and the management only listening on localhost, and splunk syslog and forwarder ports listening on 0.0.0.0 or a specific IP???

mikelanghorst
Motivator

http://docs.splunk.com/Documentation/Splunk/4.3.2/Admin/BindSplunktoanIP

You should be able to set SPLUNK_BINDIP=127.0.0.1 in $splunk_home/etc/splunk-launch.conf so it will only bind to localhost.

View solution in original post

cwacha
Path Finder

Great! This did the trick. Thanks!

0 Karma