Security

Can I disable the Management Port 8089 in a Light Forwarder?

Splunk Employee
Splunk Employee

Due to internal secure policies the mgmPort must be disabled: I don't want anything to be able to talk through any port of my Light Forwarder, instead I want it to be an output-only box.

In term of security, if you don't use a component, always better to disable it.

Is it possible to suppress this functionality?

1 Solution

Splunk Employee
Splunk Employee

In the file:
$SPLUNK_HOME/etc/system/local/server.conf

add the entry:

[httpServer]
disableDefaultPort = true

Then restart Splunk.

View solution in original post

New Member

can forwarders still receive updates from the deployment server if the daemon is off?

0 Karma

Path Finder

Yes, because it is a pull-type of connection.

0 Karma

Splunk Employee
Splunk Employee

In addition once you set 'disableDefaultPort=true' you will notice that upon start/restart Splunk will still check on the availability of the management port. This does NOT mean that it will use the port eventually.

Note: You will not be able to run successfully CLI admin commands as they retrieve information from Splunk's endpoint using the management port.

Splunk Employee
Splunk Employee

In the file:
$SPLUNK_HOME/etc/system/local/server.conf

add the entry:

[httpServer]
disableDefaultPort = true

Then restart Splunk.

View solution in original post