topic Re: Any handy way to know what cipher Splunk server supports? in Security

Any handy way to know what cipher Splunk server supports?

daniel_splunk — Fri, 24 Aug 2018 09:25:21 GMT

I want to tighten the security by only allowing certain ciphers to be configured. Any handy tool to check what cipher Splunk currently supports?

Re: Any handy way to know what cipher Splunk server supports?

daniel_splunk — Fri, 24 Aug 2018 09:29:48 GMT

Here is some script that you can use to test the Splunk port by using openssl.

#!/usr/bin/env bash

# OpenSSL requires the server IP and port number
SERVER=127.0.0.1:8089
DELAY=1
ciphers=$(openssl ciphers 'ALL:eNULL' | sed -e 's/:/ /g')

echo Obtaining cipher list from $(openssl version).

for cipher in ${ciphers[@]}
do
echo -n Testing $cipher...
result=$(echo -n | openssl s_client -cipher "$cipher" -connect $SERVER 2>&1)
if [[ "$result" =~ ":error:" ]] ; then
  error=$(echo -n $result | cut -d':' -f6)
  echo NO \($error\)
else
  if [[ "$result" =~ "Cipher is ${cipher}" || "$result" =~ "Cipher    :" ]] ; then
    echo YES
  else
    echo UNKNOWN RESPONSE
    echo $result
  fi
fi
sleep $DELAY
done

A sample run again Splunk 7.1.2 with port 8089 will below result.

# ./openssl.sh | grep YES
Testing ECDHE-RSA-AES256-GCM-SHA384...YES
Testing ECDHE-RSA-AES256-SHA384...YES
Testing AES256-GCM-SHA384...YES
Testing ECDHE-RSA-AES128-GCM-SHA256...YES
Testing ECDHE-RSA-AES128-SHA256...YES
Testing AES128-GCM-SHA256...YES
Testing AES128-SHA256...YES

Re: Any handy way to know what cipher Splunk server supports?

inventsekar — Fri, 24 Aug 2018 09:47:13 GMT

https://docs.splunk.com/Documentation/Splunk/7.1.2/Security/Ciphersuites

inputs.conf

   sslVersions = tls1.2
    cipherSuite = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-
    SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-
    AES128-SHA256:ECDHE-RSA-AES128-SHA256
    ecdhCurves = prime256v1, secp384r1, secp521r1

Re: Any handy way to know what cipher Splunk server supports?

mstjohn_splunk — Fri, 24 Aug 2018 21:09:27 GMT

Hi @daniel_splunk - Were you able to test out @inventsekar 's solution? Or, did your answer below solve the problem? If yes to either of those options, please don't forget to resolve this post by clicking on "Accept". If you still need more help, please provide a comment with some feedback. Thanks!