topic Re: security question - data transmitted (from forwarder) in Security

security question - data transmitted (from forwarder)

mf2268 — Wed, 23 May 2012 15:49:50 GMT

Hi,,,
we are looking to install splunk.
scenario - unix and windows devices ... syslog unix server
what i would like to do is install splunk on syslog server; install forwarder on unix and wintel servers.
my question: how is data secured as it is sent to syslog (splunk server)
ssh , tls
is there a preference

any info you can provide is appreciated.

Re: security question - data transmitted (from forwarder)

ChrisG — Wed, 23 May 2012 16:21:14 GMT

You can enable SSL on the forwarders (using outputs.conf) and receiver (using inputs.conf). See Use SSL to encrypt and authenticate data from forwarders in the Admin Manual.

Re: security question - data transmitted (from forwarder)

mf2268 — Wed, 23 May 2012 19:11:32 GMT

thank you.

Re: security question - data transmitted (from forwarder)

jworthington_sp — Wed, 23 May 2012 20:53:58 GMT

There are also some security tips on the Wiki that might be helpful:

http://wiki.splunk.com/Community:Security_and_compliance

Re: security question - data transmitted (from forwarder)

araitz — Thu, 24 May 2012 05:57:33 GMT

While you are at it, don't forget to review http://docs.splunk.com/Documentation/Splunk/latest/Admin/Hardeningstandards