Security

Can I disable the Management Port 8089 in a Light Forwarder?

mzorzi
Splunk Employee
Splunk Employee

Due to internal secure policies the mgmPort must be disabled: I don't want anything to be able to talk through any port of my Light Forwarder, instead I want it to be an output-only box.

In term of security, if you don't use a component, always better to disable it.

Is it possible to suppress this functionality?

1 Solution

mzorzi
Splunk Employee
Splunk Employee

In the file:
$SPLUNK_HOME/etc/system/local/server.conf

add the entry:

[httpServer]
disableDefaultPort = true

Then restart Splunk.

View solution in original post

dwalgamotte
New Member

can forwarders still receive updates from the deployment server if the daemon is off?

0 Karma

yarick
Path Finder

Yes, because it is a pull-type of connection.

0 Karma

drrushi_splunk
Splunk Employee
Splunk Employee

In addition once you set 'disableDefaultPort=true' you will notice that upon start/restart Splunk will still check on the availability of the management port. This does NOT mean that it will use the port eventually.

Note: You will not be able to run successfully CLI admin commands as they retrieve information from Splunk's endpoint using the management port.

mzorzi
Splunk Employee
Splunk Employee

In the file:
$SPLUNK_HOME/etc/system/local/server.conf

add the entry:

[httpServer]
disableDefaultPort = true

Then restart Splunk.

Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...