topic Re: Authenticated TCP Input? in Security

Authenticated TCP Input?

pezcrap — Tue, 15 Apr 2014 00:35:49 GMT

I have set up a TCP input and have noticed that it is completely open by default. (For example if I hit that port from a web browser, it interprets the HTTP request as an event to be ingested). I need to be able to prevent arbitrary garbage from being ingested.

I see in the docs that it is possible to lock down the import to specific hosts or IP addresses, but I need to be able to support data ingestion from anywhere. What I really need is some form of authentication on the input.

Is this possible with TCP inputs?

If not, I assume I would need to build my own authenticated TCP interface and then stream the data from that to Splunk. Is this a good approach? What is the best way to stream the data? Some sort of persistent queue?

Re: Authenticated TCP Input?

LukeMurphey — Tue, 15 Apr 2014 04:18:36 GMT

What about using something like IPSEC between the hosts? Setting up an IPSEC policy on Windows is particularly simple. You can configure the policy such that it only allows communication on the given port if it is authenticated and secured.

Re: Authenticated TCP Input?

martin_mueller — Tue, 15 Apr 2014 08:20:00 GMT

As an alternative to building your own authenticated TCP input you could use the existing Splunk REST API endpoints: http://docs.splunk.com/Documentation/Splunk/6.0.3/RESTAPI/RESTinput#receivers.2Fsimple for single events, http://docs.splunk.com/Documentation/Splunk/6.0.3/RESTAPI/RESTinput#receivers.2Fstream for streamed events.

Re: Authenticated TCP Input?

pezcrap — Thu, 17 Apr 2014 02:29:19 GMT

Hi martin - that streamed events receiver looks useful. Is this exposed via the Java SDK? (I can't seem to find it) or it it necessary to hit the REST API directly?

Re: Authenticated TCP Input?

martin_mueller — Thu, 17 Apr 2014 07:13:36 GMT

Not quite sure about the regular SDK, however if you're already working in Java you should take a look at https://github.com/damiendallimore/SplunkJavaLogging for logging directly to Splunk. On top of logging via TCP that comes with an implementation of logging to the authenticated REST API.

Re: Authenticated TCP Input?

rdimri_splunk — Sat, 20 Aug 2016 00:19:57 GMT

So I think that there are couple of ways to address this.
1) If your fowarding system is non-splunk: By writing a small proxy. You could spawn a small multi threaded TCP server (in python for ease), and then have some form of authentication of forwarders, as a handshake step after connection is established. After handshake is done you can just blindly start forwarding data to the tcpinput port.
2) If you forwarding system is Splunk based: There is a mechanism of setting up shared secret keys between forwarding an receiving side. You can do this by https://docs.splunk.com/Documentation/Forwarder/6.4.2/Forwarder/Controlforwarderaccess#Configure_the_indexer_with_the_token