When Splunk Enterprise is distributed over multiple servers, each server must be configured to disable non-essential capabilities.

Applications are capable of providing a wide variety of functions and services. Some of the functions and services may not be necessary to support the configuration. This becomes more of an issue in distributed environments, where the application functions are spread out over multiple servers.

These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors.

If the Splunk Installation is not distributed among multiple servers, this check is N/A.

If the machine being reviewed is not designated as a search head, check the following file in the Splunk installation folders:

$SPLUNK_HOME/etc/system/local/web.conf

Check for the following lines:

[settings] startwebserver = 0

If the startwebserver = 0 line is missing, or is = 1, this is a finding.

If the machine being reviewed is not designated as an indexer, check the following file in the Splunk installation folders:

$SPLUNK_HOME/etc/system/local/indexes.conf

If this file exists, this is a finding.

This file should only exist on an instance designated as an indexer.

If the Splunk Installation is not distributed among multiple servers, this fix is N/A.

Select Settings >> Monitoring Console.

In the Monitoring Console, select Settings >> General Setup.

Set the Mode type based on the implementation design.

If Mode is set to Distributed, set each instance only with the server roles necessary for the desired functions.

On instances not designated as search heads, disable the web UI by using the following command:

./splunk disable webserver

On instances not designated as indexers, remove the file:

$SPLUNK_HOME/etc/system/local/indexes.conf