How to limit mgmt port access to localhost only on Universal Forwarder or Heavy Forwarder

[cwacha]

For security reasons we would like to disable the management port but unfortunately very neat debugging commands such as

./bin/splunk list monitor

stop working after that. It would be ok if we have the port enabled but accessible only for localhost communication. Altough the configuration explicitly sets the localhost IP address it is still possible to open telnet connections from other ports.

web.conf
[settings]
mgmtHostPort = 127.0.0.1:8089

Even netstat shows that the port is open on every available network interface.

# netstat -an | grep 8089
tcp        0      0 0.0.0.0:8089                0.0.0.0:*                   LISTEN      

Question: how can we force the Universal Forwarder (or even the Heavy Forwarder) to bind to the localhost interface only?

[jespencer_splun]

I think your best bet is to bind locally via splunk-launch.conf then use iptables (DNAT) or xinetd (redirect) to forward inbound requests to the ports you wish to expose.

That's more of a security first answer than the alternative of locking down the other ports Splunk listens to at 0.0.0.0.

Ask your SE to submit a feature enhancement request for binding address on a per listener basis if that's important to your specific use case.

[bricker]

We also would like the mgmt port to listen only on localhost as well. The port on the IP is being picked up app scans and coming up with SSL vulnerabilities so it would be best to not have it on the network on every host.

Has anyone been able to get it to bind only to 127.0.0.1?

[redoracle]

Yes, but then you have have everything bonded to that IP...

what about if I want the http listener and the management only listening on localhost, and splunk syslog and forwarder ports listening on 0.0.0.0 or a specific IP???

[mikelanghorst · Accepted solution]

http://docs.splunk.com/Documentation/Splunk/4.3.2/Admin/BindSplunktoanIP

You should be able to set SPLUNK_BINDIP=127.0.0.1 in $splunk_home/etc/splunk-launch.conf so it will only bind to localhost.

[cwacha]

Great! This did the trick. Thanks!