Getting Data In

Splunk Web & Splunkd HTTP Server response header

deyeo
Path Finder
  1. How do i remove the Splunk web http server response header?

Server: CherryPy/3.1.2

  1. How do i remove the Splunk daemon http server response header?

Server: Splunkd

  1. Any operational issues if the 2 response header are removed?
Tags (2)
1 Solution

dwaddle
SplunkTrust
SplunkTrust

I imagine you trying to remove these to satisfy some security / obfuscation requirement.

As far as the Splunkweb CherryPy header goes, that should be in the CherryPy python code somewhere. This is obviously editable by you in your own installation. However, you'll need to be incredibly careful to not break anything -- and this would be overwritten on upgrades.

For the Splunkd header itself, this is compiled into splunkd. I guess you could patch the binary with a hex editor, replacing the "Splunkd" characters with NULLs. This would be EXTREMELY RISKY and not at all recommended.

If this is important to you, I would recommend submitting and Enhancement Request with the details behind why this is needed and exactly what enhancement you are looking for.

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

I imagine you trying to remove these to satisfy some security / obfuscation requirement.

As far as the Splunkweb CherryPy header goes, that should be in the CherryPy python code somewhere. This is obviously editable by you in your own installation. However, you'll need to be incredibly careful to not break anything -- and this would be overwritten on upgrades.

For the Splunkd header itself, this is compiled into splunkd. I guess you could patch the binary with a hex editor, replacing the "Splunkd" characters with NULLs. This would be EXTREMELY RISKY and not at all recommended.

If this is important to you, I would recommend submitting and Enhancement Request with the details behind why this is needed and exactly what enhancement you are looking for.

deyeo
Path Finder

removing or modifying the CherryPy header will affect the PDFserver ability to generate PDF. thus, you need to modify the PDFserver code at ../splunk/etc/apps/pdfserver/bin/pdfhandler.py

Comment out these 3 lines to not check for the existence of CherryPy header:

if 'CherryPy' not in response.get('server', ''):
logger.warn("Remote web server at %s doesn't appear to be running CherryPy" % version_url)
return False

0 Karma

deyeo
Path Finder

the closet file that i can locate is: ..\splunk\lib\python2.6\site-packages\cherrypy_cprequest.py

is this the correct file?

0 Karma

deyeo
Path Finder

which particular py file contains the Splunkweb CherryPy header ?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...