Security

why doesn't splunk work with my reverse proxy?

Chubbybunny
Splunk Employee
Splunk Employee

my current ~/system/local/web.conf is configured as

[settings]
httpport = 8080
mgmtHostPort = 127.0.0.1:28502
root_endpoint = /
enableSplunkWebSSL = true

And my apache httpd.conf

   <"Location/splunksup">
    Order allow,deny 
    Allow from all 
    <"/Location"> 

    ProxyPass / https://192.168.1.1:8080/
    ProxyPassReverse / https:/192.168.1.1:8080/
1 Solution

Masa
Splunk Employee
Splunk Employee

Sorry to be a party-pooper...

This is your scenario;

User Brower <--Non SSL--> Reverse Proxy Server <--- SSL ---> Splunk

  1. In httpd.conf, you need "sslproxyengine on" for this scenario
  2. In web.conf for 4.3.x, we introduced new attributes for web.conf. One of them will make Splunkweb more secure. But, in your scenario, this needs to disabled it.
- web.conf
[settings]
httpport = 8080
mgmtHostPort = 127.0.0.1:28502
root_endpoint = /
enableSplunkWebSSL = true
# This attribute is required for a browser's insecure session 
tools.sessions.secure = False

For more information, please visit a spec file;


- web.conf.spec
tools.sessions.secure = [True | False]
* If set to True and Splunkweb is configured to server requests using HTTPS
(see the enableSplunkWebSSL setting) then the browser will only transmit
the session cookie over HTTPS connections, increasing session security
* Defaults to True

View solution in original post

Masa
Splunk Employee
Splunk Employee

Sorry to be a party-pooper...

This is your scenario;

User Brower <--Non SSL--> Reverse Proxy Server <--- SSL ---> Splunk

  1. In httpd.conf, you need "sslproxyengine on" for this scenario
  2. In web.conf for 4.3.x, we introduced new attributes for web.conf. One of them will make Splunkweb more secure. But, in your scenario, this needs to disabled it.
- web.conf
[settings]
httpport = 8080
mgmtHostPort = 127.0.0.1:28502
root_endpoint = /
enableSplunkWebSSL = true
# This attribute is required for a browser's insecure session 
tools.sessions.secure = False

For more information, please visit a spec file;


- web.conf.spec
tools.sessions.secure = [True | False]
* If set to True and Splunkweb is configured to server requests using HTTPS
(see the enableSplunkWebSSL setting) then the browser will only transmit
the session cookie over HTTPS connections, increasing session security
* Defaults to True

jbsplunk
Splunk Employee
Splunk Employee

The reason that Splunk doesn't work with your reverse proxy is that there is a bug where using a reverse proxy w/ SSL enabled will result in redirects to login page, not a successful login(SPL-58866). This is something that has recently been discovered and there is not a fix available at the time. The issue dates back to at least 4.3.4.

Chubbybunny
Splunk Employee
Splunk Employee

thanks JB!!!

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...