Installation

Unable to get Splunk Ent. Web to use Port 80 for non-privileged user

evolutionxtinct
Explorer

Hello All!

I'm setting up Splunk Ent. 8.2 on RHEL 8 and wanted to try not utilizing Root as much as possible (Forewarning we are a Windows shop so if this isn't possible please help us understand). I've setup a User called splunk in place of the default admin account it wants to create. We noticed when trying to setup the configuration to port 80 that it would never work, and we ended up having to go back to Port 8000.

I've read up and seen that you can utilize Apache as a proxy to get around this, but that was a pretty old document and not sure if it still applies for newer versions of RHEL or if there is a better approach.

Any help would be greatly appreciated as we are a small shop and are trying to juggle this in the midst of multiple other projects. 

Thanks! 

Labels (1)
0 Karma

KaneKennedyNHSD
New Member

Relatively simple way to perform what you want to accomplish:

Start the Splunk service on 8000 as normal and redirect it with iptables

sudo iptables -t nat -I OUTPUT -p tcp -d 127.0.0.1 --dport 80 -j REDIRECT --to-ports 8000
sudo iptables -t nat -I PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 8000

In reality you should get away from port 80 and only present with SSL, you could use nginx to forward port 80 to 443 with a self signed cert.


 

server {
    listen 80;
    return 301 https://$host$request_uri;
}

server {

    listen 443;
    server_name www.example.com;

    ssl_certificate           /etc/nginx/cert.crt;
    ssl_certificate_key       /etc/nginx/cert.key;

    ssl on;

    location / {

      proxy_set_header        Host $host;
      proxy_set_header        X-Real-IP $remote_addr;
      proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header        X-Forwarded-Proto $scheme;

      proxy_pass          http://localhost:8000;
    }
}

 

0 Karma

codebuilder
SplunkTrust
SplunkTrust

You can also use a load balancer such as HAProxy to route default web port on your VIP to Splunk's port 8000.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Only privileged users can open ports < 1024.

Why do you need to use port 80?  Splunk works fine with port 8000.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...