SamEureka/splunk-nginx.md

## splunk-nginx.md

      
      Raw
    
  
              splunk-nginx.md
            
          
    Installing Splunk w/NGINX SSL Reverse Proxy
The steps outlined here make many assumptions about both your operating environment and your understanding of the Linux OS and services running on Linux. I am using the current LTS Ubuntu distribution 16.04 running in the cloud on a DigitalOcean Droplet. These steps should work just fine if followed closely and in order... but you know sh!& never works out the way you plan in Linux. I offer some troubleshooting advice, Google and Stack are your friends ask them for help.


SSH into your pre-configured server running NGINX SSL Reverse Proxy ssh <username>@<server-url-or-IP> **See guide here


Download Splunk Enterprise using WGET wget -O splunk-6.5.1-f74036626f0c-linux-2.6-amd64.deb 'https://www.splunk.com/bin/splunk/DownloadActivityServlet?architecture=x86_64&platform=linux&version=6.5.1&product=splunk&filename=splunk-6.5.1-f74036626f0c-linux-2.6-amd64.deb&wget=true' Note: you might need to sign up and fill out stuff to get this download URL to work. I didn't... but your milage may vary.


Install Splunk using dpkg sudo dpkg -i splunk-6.5.1-f74036626f0c-linux-2.6-amd64.deb Note: versions change... make sure you are using the most current. This listed files are just an example


Start Splunk sudo /opt/splunk/bin/./splunk start --accept-license


Edit/create web.conf file sudo pico /opt/splunk/etc/system/local/web.conf


[settings]
root_endpoint = /splunk
tools.proxy.on = false
enableSplunkWebSSL = true
privKeyPath = /etc/letsencrypt/live/<server-url>/privkey.pem
serverCert = /etc/letsencrypt/live/<server-url>/fullchain.pem


Restart Splunkweb sudo /opt/splunk/bin/./splunk restart splunkweb
Create a backup of your NGINX site config file sudo cp /etc/nginx/sites-available/default /etc/nginx/sites-available/default.ssl-test.backup
Edit your NGINX site config file sudo pico /etc/nginx/sites-available/default

# Port 80 http redirect
server {
  listen 80 default_server;
  server_name <server-url>;
  return 301 https://$server_name$request_uri;
}
# Port 443 https config
server {
  listen 443 ssl http2 default_server;
  server_name <server-url>;
  large_client_header_buffers 6 16k;
  client_max_body_size 4M;
  include snippets/ssl-<server-url>.conf;
  include snippets/ssl-params.conf;
  location / {
             proxy_pass_request_headers on;
             proxy_set_header x-real-IP $remote_addr;
             proxy_set_header x-forwarded-for $proxy_add_x_forwarded_for;
             proxy_set_header host $host;
             proxy_pass https://<server-url>:8000/;
         }
}


Save your changes then test your config with sudo nginx -t


If your changes are passing, sudo systemctl restart nginx


Boom... it works! Right?