Splunk Dev

How can i put password protection on 8000 port

montu
New Member

While following the snort 3 manual, after putting the license of splunk on free option, the password protection is gone. Now any computer of my internal and probably external network can log into my 8000 port without any protection. how to put a password protection on this port?

Labels (1)
0 Karma

dwaddle
SplunkTrust
SplunkTrust

You didn't say whether this is your lab or for your business or what.  Some things you can do:

  1.  License Splunk Enterprise and install the Enterprise license.  This gives you support and so on, but is probably out of reach for personal budget.
  2. If this is your NONPRODUCTION lab environment and you can abide by the terms of the development license, get a development license.  See https://dev.splunk.com/enterprise/dev_license.
  3. Put a reverse proxy like Nginx in front of Splunk's UI.  Move Splunk to 127.0.0.1 on an alternate port.  Make the reverse proxy do authentication.  Note this still leaves you with an extremely limited Splunk Free that does not have scheduling or alerts or all of the other features you'll be missing.  This requires a little sysadmin skill to pull off successfully.

richgalloway
SplunkTrust
SplunkTrust
Use a firewall to protect port 8000. You can also buy a Splunk license to restore password-controlled access.
---
If this reply helps you, Karma would be appreciated.

montu
New Member

I am kind of new in this era can you suggest me any free firewall for kali linux? and "how should i implement on" documentation.

0 Karma

richgalloway
SplunkTrust
SplunkTrust
I have no experience with Kali Linux, but a quick Google search of "kali linux firewall" returns several promising results.
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...