Installation

Unable to get Splunk Ent. Web to use Port 80 for non-privileged user

evolutionxtinct
Explorer

Hello All!

I'm setting up Splunk Ent. 8.2 on RHEL 8 and wanted to try not utilizing Root as much as possible (Forewarning we are a Windows shop so if this isn't possible please help us understand). I've setup a User called splunk in place of the default admin account it wants to create. We noticed when trying to setup the configuration to port 80 that it would never work, and we ended up having to go back to Port 8000.

I've read up and seen that you can utilize Apache as a proxy to get around this, but that was a pretty old document and not sure if it still applies for newer versions of RHEL or if there is a better approach.

Any help would be greatly appreciated as we are a small shop and are trying to juggle this in the midst of multiple other projects. 

Thanks! 

Labels (1)
0 Karma

KaneKennedyNHSD
New Member

Relatively simple way to perform what you want to accomplish:

Start the Splunk service on 8000 as normal and redirect it with iptables

sudo iptables -t nat -I OUTPUT -p tcp -d 127.0.0.1 --dport 80 -j REDIRECT --to-ports 8000
sudo iptables -t nat -I PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 8000

In reality you should get away from port 80 and only present with SSL, you could use nginx to forward port 80 to 443 with a self signed cert.


 

server {
    listen 80;
    return 301 https://$host$request_uri;
}

server {

    listen 443;
    server_name www.example.com;

    ssl_certificate           /etc/nginx/cert.crt;
    ssl_certificate_key       /etc/nginx/cert.key;

    ssl on;

    location / {

      proxy_set_header        Host $host;
      proxy_set_header        X-Real-IP $remote_addr;
      proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header        X-Forwarded-Proto $scheme;

      proxy_pass          http://localhost:8000;
    }
}

 

0 Karma

codebuilder
SplunkTrust
SplunkTrust

You can also use a load balancer such as HAProxy to route default web port on your VIP to Splunk's port 8000.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Only privileged users can open ports < 1024.

Why do you need to use port 80?  Splunk works fine with port 8000.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>