Security

Can I disable the Management Port 8089 in a Light Forwarder?

mzorzi
Splunk Employee
Splunk Employee

Due to internal secure policies the mgmPort must be disabled: I don't want anything to be able to talk through any port of my Light Forwarder, instead I want it to be an output-only box.

In term of security, if you don't use a component, always better to disable it.

Is it possible to suppress this functionality?

1 Solution

mzorzi
Splunk Employee
Splunk Employee

In the file:
$SPLUNK_HOME/etc/system/local/server.conf

add the entry:

[httpServer]
disableDefaultPort = true

Then restart Splunk.

View solution in original post

dwalgamotte
New Member

can forwarders still receive updates from the deployment server if the daemon is off?

0 Karma

yarick
Path Finder

Yes, because it is a pull-type of connection.

0 Karma

drrushi_splunk
Splunk Employee
Splunk Employee

In addition once you set 'disableDefaultPort=true' you will notice that upon start/restart Splunk will still check on the availability of the management port. This does NOT mean that it will use the port eventually.

Note: You will not be able to run successfully CLI admin commands as they retrieve information from Splunk's endpoint using the management port.

mzorzi
Splunk Employee
Splunk Employee

In the file:
$SPLUNK_HOME/etc/system/local/server.conf

add the entry:

[httpServer]
disableDefaultPort = true

Then restart Splunk.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...