Security

Is it possible to setup HEC to use multiple/unique ports and ssl certificates for multiple/unique senders?

Glasses
Builder

Hi
When I create a new input for HTTP Event Collector via the WebUI

Under /opt/splunk/etc/apps/search/local inputs.conf
I see the input stanza:

[http://test_recieve_http_post]
disabled = 0
index = main
indexes = main
sourcetype = test_http_post
token = blah-blah-blah-blah-blah

in /opt/splunk/etc/apps/splunk_httpinput/local

[http]
index = main
port = 6666
sourcetype = test_http_post
disabled = 0
enableSSL = 1
sslPassword = <some_password>
privKeyPath = /opt/splunk/etc/auth/my_certs/hec.key
serverCert = /opt/splunk/etc/auth/my_certs/hec.pem

From the WebUI it appears that you cannot give the HEC multiple ports, as there is only one inputbox for port... but I would like to have multiple ports with there own ssl certs.... like 6666 hec.key, hec.pem, and 6667 hec2.key, hec2, pem.... so that I can provide separate ports and ssl certs to each sender...

Is there a way to override this?

Thank you.

0 Karma
1 Solution

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

You can't configure HEC to listen on multiple port with different SSL certificate. If you want to achieve this then you can configure Load Balancer to receive traffic on different port with different SSL certificate then offload SSL traffic on LB & on upstream send traffic to single HEC port.

View solution in original post

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

You can't configure HEC to listen on multiple port with different SSL certificate. If you want to achieve this then you can configure Load Balancer to receive traffic on different port with different SSL certificate then offload SSL traffic on LB & on upstream send traffic to single HEC port.

starcher
SplunkTrust
SplunkTrust

And why would you? The senders don't need client certs. Just to trust the root CA of the cert the HEC is using.

0 Karma

Glasses
Builder

IDK someone with a "good idea" wanted me too... thank you for the comment, I agree with you.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...