Security

Is it possible to setup HEC to use multiple/unique ports and ssl certificates for multiple/unique senders?

Glasses
Communicator

Hi
When I create a new input for HTTP Event Collector via the WebUI

Under /opt/splunk/etc/apps/search/local inputs.conf
I see the input stanza:

[http://test_recieve_http_post]
disabled = 0
index = main
indexes = main
sourcetype = test_http_post
token = blah-blah-blah-blah-blah

in /opt/splunk/etc/apps/splunk_httpinput/local

[http]
index = main
port = 6666
sourcetype = test_http_post
disabled = 0
enableSSL = 1
sslPassword = <some_password>
privKeyPath = /opt/splunk/etc/auth/my_certs/hec.key
serverCert = /opt/splunk/etc/auth/my_certs/hec.pem

From the WebUI it appears that you cannot give the HEC multiple ports, as there is only one inputbox for port... but I would like to have multiple ports with there own ssl certs.... like 6666 hec.key, hec.pem, and 6667 hec2.key, hec2, pem.... so that I can provide separate ports and ssl certs to each sender...

Is there a way to override this?

Thank you.

0 Karma
1 Solution

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

You can't configure HEC to listen on multiple port with different SSL certificate. If you want to achieve this then you can configure Load Balancer to receive traffic on different port with different SSL certificate then offload SSL traffic on LB & on upstream send traffic to single HEC port.

View solution in original post

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

You can't configure HEC to listen on multiple port with different SSL certificate. If you want to achieve this then you can configure Load Balancer to receive traffic on different port with different SSL certificate then offload SSL traffic on LB & on upstream send traffic to single HEC port.

View solution in original post

starcher
SplunkTrust
SplunkTrust

And why would you? The senders don't need client certs. Just to trust the root CA of the cert the HEC is using.

0 Karma

Glasses
Communicator

IDK someone with a "good idea" wanted me too... thank you for the comment, I agree with you.

0 Karma