Splunk w/ NGINX SSL Reverse Proxy

splunk-nginx.md

Installing Splunk w/NGINX SSL Reverse Proxy

The steps outlined here make many assumptions about both your operating environment and your understanding of the Linux OS and services running on Linux. I am using the current LTS Ubuntu distribution 16.04 running in the cloud on a DigitalOcean Droplet. These steps should work just fine if followed closely and in order... but you know sh!& never works out the way you plan in Linux. I offer some troubleshooting advice, Google and Stack are your friends ask them for help.

1. SSH into your pre-configured server running NGINX SSL Reverse Proxy ssh <username>@<server-url-or-IP> **See guide here

2. Download Splunk Enterprise using WGET wget -O splunk-6.5.1-f74036626f0c-linux-2.6-amd64.deb 'https://www.splunk.com/bin/splunk/DownloadActivityServlet?architecture=x86_64&platform=linux&version=6.5.1&product=splunk&filename=splunk-6.5.1-f74036626f0c-linux-2.6-amd64.deb&wget=true' Note: you might need to sign up and fill out stuff to get this download URL to work. I didn't... but your milage may vary.

3. Install Splunk using dpkg sudo dpkg -i splunk-6.5.1-f74036626f0c-linux-2.6-amd64.deb Note: versions change... make sure you are using the most current. This listed files are just an example

4. Start Splunk sudo /opt/splunk/bin/./splunk start --accept-license

5. Edit/create web.conf file sudo pico /opt/splunk/etc/system/local/web.conf

[settings]
root_endpoint = /splunk
tools.proxy.on = false
enableSplunkWebSSL = true
privKeyPath = /etc/letsencrypt/live/<server-url>/privkey.pem
serverCert = /etc/letsencrypt/live/<server-url>/fullchain.pem

6. Restart Splunkweb sudo /opt/splunk/bin/./splunk restart splunkweb
7. Create a backup of your NGINX site config file sudo cp /etc/nginx/sites-available/default /etc/nginx/sites-available/default.ssl-test.backup
8. Edit your NGINX site config file sudo pico /etc/nginx/sites-available/default

# Port 80 http redirect
server {
  listen 80 default_server;
  server_name <server-url>;
  return 301 https://$server_name$request_uri;
}
# Port 443 https config
server {
  listen 443 ssl http2 default_server;
  server_name <server-url>;
  large_client_header_buffers 6 16k;
  client_max_body_size 4M;
  include snippets/ssl-<server-url>.conf;
  include snippets/ssl-params.conf;
  location / {
             proxy_pass_request_headers on;
             proxy_set_header x-real-IP $remote_addr;
             proxy_set_header x-forwarded-for $proxy_add_x_forwarded_for;
             proxy_set_header host $host;
             proxy_pass https://<server-url>:8000/;
         }
}

23. Save your changes then test your config with sudo nginx -t

24. If your changes are passing, sudo systemctl restart nginx

25. Boom... it works! Right?

Spunk light download URL

wget -O splunklight-6.5.2-67571ef4b87d-linux-2.6-amd64.deb 'https://www.splunk.com/bin/splunk/DownloadActivityServlet?architecture=x86_64&platform=linux&version=6.5.2&product=splunk_light&filename=splunklight-6.5.2-67571ef4b87d-linux-2.6-amd64.deb&wget=true'

Splunk Enterprise 6.5.2 download URL

wget -O splunk-6.5.2-67571ef4b87d-linux-2.6-amd64.deb 'https://www.splunk.com/bin/splunk/DownloadActivityServlet?architecture=x86_64&platform=linux&version=6.5.2&product=splunk&filename=splunk-6.5.2-67571ef4b87d-linux-2.6-amd64.deb&wget=true'

Universal Forwarder download URL

wget -O splunkforwarder-6.5.2-67571ef4b87d-linux-2.6-amd64.deb 'https://www.splunk.com/bin/splunk/DownloadActivityServlet?architecture=x86_64&platform=linux&version=6.5.2&product=universalforwarder&filename=splunkforwarder-6.5.2-67571ef4b87d-linux-2.6-amd64.deb&wget=true'

splunk.sameureka.com

splunk-fwd.sameureka.com

...because I'm tired of typing

client_max_body_size 25M;

added to the NGINX server config so we can upload big files in Splunk through the web interface. Mod as needed for size.

sudo tar -cvzf splunk-$(date +"%FT%H%M").tgz /opt/splunk

-- to make a backup prior to upgrading

Splunk Enterprise 6.6.0 for Linux(deb) download URL

wget -O splunk-6.6.0-1c4f3bbe1aea-linux-2.6-amd64.deb 'https://www.splunk.com/bin/splunk/DownloadActivityServlet?architecture=x86_64&platform=linux&version=6.6.0&product=splunk&filename=splunk-6.6.0-1c4f3bbe1aea-linux-2.6-amd64.deb&wget=true'

upgrading is easy... make a backup (see comment above), download the new version, and run the following,

sudo dpkg -i splunk<new_version_#>.deb

Splunk Ent 6.6.1 for Linux(deb) download URL
wget -O splunk-6.6.1-aeae3fe0c5af-linux-2.6-amd64.deb 'https://www.splunk.com/bin/splunk/DownloadActivityServlet?architecture=x86_64&platform=linux&version=6.6.1&product=splunk&filename=splunk-6.6.1-aeae3fe0c5af-linux-2.6-amd64.deb&wget=true'

This code added to /etc/nginx/snippets/ssl-params.conf to fix server abort error

add_header X-Frame-Options SAMEORIGIN;