Splunk is probably one of the greatest IT tools of all time. It is a robust monitoring and reporting tool that can index just about any type of data from several types of data inputs.
There is a free license version of the Splunk software that has a few limitations in comparison to the enterprise licensed version; one of the limitations is the inability to perform a basic method of user and password authentication (or even the full scope of PAM authentication methods). We can fix this easily with a small and lightweight installation of the freely available Nginx web server software.
For this guide, I will demonstrate the process using methods using Linux for the Splunk deployment. I will not go into the details of how to install Splunk, and will presume a prexisting installation exists.
How it Works
Below is a diagram showing the communication between the client connecting to Splunk, running on the host “splunkbox”:
Nginx will proxy all requests on port SSL 443 for https://splunkbox/splunk to the Splunk instance (running on the same server), listening only on 127.0.0.1:8000. Any attempts to bypass the authentication mechanism we configure (by making direct requests to splunkbox:8000) will be denied.
Step #1: Getting the Required Software
Your have the options of installing Nginx through your distribution or from source. If choosing a source compile, make sure you grab it from the official Nginx download page.
Step #2: Configuring Splunk
We start this process by editing the Splunk web.conf, to add the settings we need for it to run on locahost and for proxy configuration:
|
1 2 3 4 |
[settings] enableSplunkWebSSL = 0 server.socket_host = 127.0.0.1 tools.proxy.on = True root_endpoint = /splunk |
Once the web.conf file looks like the above, restart Splunk with the following command:
|
1 |
$SPLUNK_HOME/bin/splunk restart |
Splunk should now bind to localhost only and be set for accepting proxy requests (it’s a good idea to confirm that it is listening only on localhost with the netstat command).
Step #3: Nginx Configuration
This step will presume that you with to use SSL for the configuration and have properly generated the needed SSL certificates (if you do not have certificates already, refer to the Openssl documentation on how to generate a self-signed certificate). In this section we will edit the nginx.conf directly, and not cover how to setup seperate virtual host configuration files for the sake of simplicity:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 |
server { listen 443; server_name splunkbox splunkbox.domain.tld; ### Our SSL directives ssl on; ssl_certificate /path/to/server.crt; ssl_certificate_key /path/to/server.key; ssl_session_timeout 5m; # Tweak to your needs ssl_protocols SSLv3 TLSv1; ssl_ciphers HIGH:MEDIUM; ssl_prefer_server_ciphers on; access_log /var/log/nginx/splunk-access.log; error_log /var/log/nginx/splunk-error.log; location /splunk { ### Proxy directive proxy_pass http://127.0.0.1:8000/splunk/; ### Basic authentication directive auth_basic "Restricted"; auth_basic_user_file /etc/nginx/nginx.passwd; } } |
Next we create our password file for the authentication. From the Nginx documentation:
Passwords must be encoded by function crypt(3). You can create the password file with the htpasswd program from Apache.” If you do not have apache2-utils installed, see man 3 crypt on how to generate this. htpasswd -c /etc/nginx/nginx.passwd username; (prompted to enter password twice)
Now we can start Nginx with the command “nginx” from a terminal (and now would be a good time to read the Nginx man page).
Step #4: Testing the Proxy
Assuming that the nginx binary is running, and listening on the correct port, open up a browser and navigate to https://splunkbox/splunk. You should be prompted for the username and password as set in the above configuration. Once you are authenticated, you should see the Splunk interface.