Unable to get Splunk Ent. Web to use Port 80 for non-privileged user

[evolutionxtinct]

Hello All!

I'm setting up Splunk Ent. 8.2 on RHEL 8 and wanted to try not utilizing Root as much as possible (Forewarning we are a Windows shop so if this isn't possible please help us understand). I've setup a User called splunk in place of the default admin account it wants to create. We noticed when trying to setup the configuration to port 80 that it would never work, and we ended up having to go back to Port 8000.

I've read up and seen that you can utilize Apache as a proxy to get around this, but that was a pretty old document and not sure if it still applies for newer versions of RHEL or if there is a better approach.

Any help would be greatly appreciated as we are a small shop and are trying to juggle this in the midst of multiple other projects. 

Thanks! 

[KaneKennedyNHSD]

Relatively simple way to perform what you want to accomplish:

Start the Splunk service on 8000 as normal and redirect it with iptables

sudo iptables -t nat -I OUTPUT -p tcp -d 127.0.0.1 --dport 80 -j REDIRECT --to-ports 8000
sudo iptables -t nat -I PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 8000

In reality you should get away from port 80 and only present with SSL, you could use nginx to forward port 80 to 443 with a self signed cert.

---

server {
    listen 80;
    return 301 https://$host$request_uri;
}

server {

    listen 443;
    server_name www.example.com;

    ssl_certificate           /etc/nginx/cert.crt;
    ssl_certificate_key       /etc/nginx/cert.key;

    ssl on;

    location / {

      proxy_set_header        Host $host;
      proxy_set_header        X-Real-IP $remote_addr;
      proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header        X-Forwarded-Proto $scheme;

      proxy_pass          http://localhost:8000;
    }
}

[codebuilder]

You can also use a load balancer such as HAProxy to route default web port on your VIP to Splunk's port 8000.

[richgalloway]

Only privileged users can open ports < 1024.

Why do you need to use port 80?  Splunk works fine with port 8000.