Splunk SOAR

Phantom: Can I disable port 80 on phantom server?

sdubey_splunk
Splunk Employee
Splunk Employee

Phantom: Can I disable port 80 on phantom server?

Is it possible to disable port 80 on Phantom server and what is the impact? We have an internal audit team requesting for port 80 to be closed.

Labels (2)
Tags (1)
0 Karma
1 Solution

sdubey_splunk
Splunk Employee
Splunk Employee
  1. Internal communication happens on 443. We force everything over to 443 as per engineering. (initially I wasn't aware
    that internal communication betwen nginx->wsgi and nginx->postgress happens via 443 ).

  2. I tested in lab :

[root@phantom ~]# netstat -plnt | grep nginx
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 3442/nginx: master
tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 3442/nginx: master

As per /etc/nginx/conf.d/default.conf:

server {
listen 80 default_server;
server_name _;
charset utf-8;

return https://$http_host$request_uri;
}

Take a backup of /etc/nginx/conf.d/default.conf and vi /etc/nginx/conf.d/default.conf and comment the below lines:

server {

listen 80 default_server;

server_name _;

charset utf-8;

return https://$http_host$request_uri;

}

service nginx restart

Post restart as you can see port 80 is not listening.

[root@phantom ~]# netstat -plnt | grep nginx
tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 3549/nginx: master

So it would be safe for them to disable it in the /etc/nginx/conf.d/default.conf only with the caveat of: "If you have anything pointing at http://<phantom_ip/fqdn>/ it is going to break.

View solution in original post

0 Karma

sdubey_splunk
Splunk Employee
Splunk Employee
  1. Internal communication happens on 443. We force everything over to 443 as per engineering. (initially I wasn't aware
    that internal communication betwen nginx->wsgi and nginx->postgress happens via 443 ).

  2. I tested in lab :

[root@phantom ~]# netstat -plnt | grep nginx
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 3442/nginx: master
tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 3442/nginx: master

As per /etc/nginx/conf.d/default.conf:

server {
listen 80 default_server;
server_name _;
charset utf-8;

return https://$http_host$request_uri;
}

Take a backup of /etc/nginx/conf.d/default.conf and vi /etc/nginx/conf.d/default.conf and comment the below lines:

server {

listen 80 default_server;

server_name _;

charset utf-8;

return https://$http_host$request_uri;

}

service nginx restart

Post restart as you can see port 80 is not listening.

[root@phantom ~]# netstat -plnt | grep nginx
tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 3549/nginx: master

So it would be safe for them to disable it in the /etc/nginx/conf.d/default.conf only with the caveat of: "If you have anything pointing at http://<phantom_ip/fqdn>/ it is going to break.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...