topic Re: How to use default certificate ssl to encrypt data between Splunk Server and Universal Forwarder in Security

How to use default certificate ssl to encrypt data between Splunk Server and Universal Forwarder

dfigurello — Tue, 26 Aug 2014 03:54:03 GMT

Hi Splunkers,

I am trying to encrypt my data in lab to learn this feature. I need apply this feature in my financial customer, who have critical data.
In this case, I am using default splunk certification to test, located in C:\Program Files\Splunk\etc\auth

|| Splunk Server Windows 127.0.0.1:9998 || <---DATA ENCRYPTED--- || Universal Forwarder Windows ||

Universal Forwarder Windows
C:\Program Files\SplunkUniversalForwarder\etc\system\local\outputs.conf
[tcpout]
defaultGroup = default-autolb-group

[tcpout:default-autolb-group]
compressed = true
requireClientCert = false
server = 127.0.0.1:9998
sslCertPath = C:\Program Files\Splunk\etc\auth\server.pem
sslPassword = password
sslRootCAPath = C:\Program Files\Splunk\etc\auth\cacert.pem

Splunk Server
C:\Program Files\Splunk\etc\apps\search\local\inputs.conf

[splunktcp-ssl:9998]
connection_host = ip
compressed = true

[SSL]
serverCert = C:\Program Files\Splunk\etc\auth\server.pem
rootCA = C:\Program Files\Splunk\etc\auth\cacert.pem
requireClientCert = false
password = password

When I did a search, I didn't see data in my Splunk.

Anyone have any idea ?

Cheers!

Re: How to use default certificate ssl to encrypt data between Splunk Server and Universal Forwarder

MuS — Tue, 26 Aug 2014 06:23:41 GMT

Hi dfigurello,

Did you check splunkd.log for any SSL related errors? Did you do some SSL troubleshooting, if you need a hint on that follow this nice answer http://answers.splunk.com/answers/134053/ciphersuite-in-various-conf-files.

Regarding the not matching search: is it the correct index? the correct time range? Do you get anything back by using | tstats count where host=x or | metadata type=hosts ?

Hope this helps ...

cheers, MuS

Re: How to use default certificate ssl to encrypt data between Splunk Server and Universal Forwarder

dfigurello — Tue, 26 Aug 2014 12:05:46 GMT

Hi MuS,

I ran a search:
index=_internal source="C:\Program Files\Splunk\var\log\splunk\splunkd.log" SSL then I found this error event:

8/26/14
9:00:09.613 AM

08-26-2014 09:00:09.613 -0300 INFO TcpInputConfig - SSL clause not found or servercert not provided - SSL ports will not be available
host = rpti002 source = C:\Program Files\Splunk\var\log\splunk\splunkd.log sourcetype = splunkd

8/26/14
9:00:07.644 AM

08-26-2014 09:00:07.644 -0300 INFO loader - Server supporting SSL v2/v3

tks.

Re: How to use default certificate ssl to encrypt data between Splunk Server and Universal Forwarder

MuS — Wed, 27 Aug 2014 07:12:31 GMT

is your inputs.conf really here: C:\Program Files\Splunk\etc\appssearch\local\inputs.conf ?

To set custom configurations, place an inputs.conf in $SPLUNK_HOME/etc/system/local/

Re: How to use default certificate ssl to encrypt data between Splunk Server and Universal Forwarder

dfigurello — Fri, 29 Aug 2014 02:48:03 GMT

Hi MuS,
I am sorry to answer too late. I did all configuration in ..\etc\system\local then I restarted splunk and Splunkforwarder. After that, my data was indexed.

I am very grateful.