Phantom: Can I disable port 80 on phantom server?

[sdubey_splunk]

Phantom: Can I disable port 80 on phantom server?

Is it possible to disable port 80 on Phantom server and what is the impact? We have an internal audit team requesting for port 80 to be closed.

[sdubey_splunk · Accepted solution]

1. Internal communication happens on 443. We force everything over to 443 as per engineering. (initially I wasn't aware
   that internal communication betwen nginx->wsgi and nginx->postgress happens via 443 ).

2. I tested in lab :

[root@phantom ~]# netstat -plnt | grep nginx
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 3442/nginx: master
tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 3442/nginx: master

As per /etc/nginx/conf.d/default.conf:

server {
listen 80 default_server;
server_name _;
charset utf-8;

return https://$http_host$request_uri;
}

Take a backup of /etc/nginx/conf.d/default.conf and vi /etc/nginx/conf.d/default.conf and comment the below lines:

server {

listen 80 default_server;

server_name _;

charset utf-8;

return https://$http_host$request_uri;

}

service nginx restart

Post restart as you can see port 80 is not listening.

[root@phantom ~]# netstat -plnt | grep nginx
tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 3549/nginx: master

So it would be safe for them to disable it in the /etc/nginx/conf.d/default.conf only with the caveat of: "If you have anything pointing at http://<phantom_ip/fqdn>/ it is going to break.