topic Re: Does Splunk LDAP support STARTTLS? in Security

Does Splunk LDAP support STARTTLS?

mpavlas — Tue, 17 Mar 2015 09:43:10 GMT

According to Tenable we will have to disable LDAPS soon.
Is it possible to use STARTTLS on LDAP port in Splunk instead?

Re: Does Splunk LDAP support STARTTLS?

sylim_splunk — Thu, 03 Sep 2015 00:13:14 GMT

As of this writing the latest Splunk does not support STARTTLS.

Re: Does Splunk LDAP support STARTTLS?

rfaircloth_splu — Mon, 28 Oct 2019 15:54:55 GMT

LDAPS as with most things (s) such as https the s stands for secure not SSL. The LDAP server configuration determines what crypto is offered and should be updated to only permit appropriately secure TLS options. "STARTTLS" is a potentially less secure choice where the server defaults to insecure communication and requires the client to request a step up to secure. This was a useful bridge for legacy communications such as LDAP, SMTP, and FTP but is not related to the need to remove support for older now less secure encryption protocols SSL* TLS 1.0 and TLS 1.1

Presuming your LDAP server is Microsoft Active Directory this vulnerability should be reviewed by your Active Directory admins to resolve.

This may also be a great time to consider moving to SAML based authentication to reduce the risk of credential compromise via plain text bind.

Re: Does Splunk LDAP support STARTTLS?

jpl3harris — Mon, 02 Dec 2019 17:16:59 GMT

This is not an answer. This is weasely language to put off the fact that we don't have a clear answer. Does Splunk support STARTTLS or not? It is a Yes or No answer.

"STARTTLS" is a potentially less secure choice where the server defaults to insecure communication
This is avoiding the technical question and a non-answer.

This was a useful bridge for legacy communications such as LDAP, SMTP, and FTP but is not related to the need to remove support for older now less secure encryption protocols SSL* TLS 1.0 and TLS 1.1
The question is not about the default security considerations of the users LDAP server.

Re: Does Splunk LDAP support STARTTLS?

rfaircloth_splu — Mon, 02 Dec 2019 17:27:54 GMT

the original answer "no start TLS" is the correct answer. My response was to provide additional color to the reason for the question which is a vuln scanner is driving an incorrect response to "disable" ldaps. When the proper fix is simply to harden ldaps.