topic Splunk Enterprise 8089 Vulnerability Scan Results: How do I resolve these SSL errors? in Security

Splunk Enterprise 8089 Vulnerability Scan Results: How do I resolve these SSL errors?

serwin — Fri, 29 Jul 2016 16:25:53 GMT

Hello,

I'm required to scan my Splunk Enterprise environment for compliance reasons. When I'm scanning my search heads and indexers ,I keep getting multiple SSL errors for the management port 8089. I've searched and haven't found a way figure out a method to upload a third party cert to fix this or if this is something that I'll just have to make not isn't fixable. I've included some of the vulnerability issues I've found. Not sure if opening a ticket with support would get me the information I need.

SSL Version 2 and 3 Protocol Detected
SSL Cert Signed Using Weak Hashing Algorithm (SHA1)
SSL Certificate Wrong Hostname (Splunk Self Signed Cert running on 8089)
TLS CRIME Vulnerability

Thanks!

Re: Splunk Enterprise 8089 Vulnerability Scan Results: How do I resolve these SSL errors?

Raghav2384 — Fri, 29 Jul 2016 16:45:15 GMT

What version of Splunk?

If you 6.3+ you can have splunk use TLV1.2 cipherSuite OR upgrade Splunk to 6.4. Add that in your server.conf and everywhere else (inputs/outputs and web) Hope this helps!

Thanks,
Raghav

Re: Splunk Enterprise 8089 Vulnerability Scan Results: How do I resolve these SSL errors?

serwin — Fri, 29 Jul 2016 16:47:39 GMT

using splunk 6.4.1, you got a link handy and i'll read through that?

Thanks!

Re: Splunk Enterprise 8089 Vulnerability Scan Results: How do I resolve these SSL errors?

Jarohnimo — Fri, 29 Jul 2016 16:50:45 GMT

You sure they can't allow exclusions? Generally all servers must be scanned to pass security compliance but even so exceptions are usually made provided justification for enterprise systems

Re: Splunk Enterprise 8089 Vulnerability Scan Results: How do I resolve these SSL errors?

serwin — Fri, 29 Jul 2016 16:59:57 GMT

Generally, yes I should be able to exclude if I need to but... more than likely I'll need a reason why I'm leaving this enabled (yay compliance). Thanks for the suggestion though, that may be what has to happen.

Re: Splunk Enterprise 8089 Vulnerability Scan Results: How do I resolve these SSL errors?

Masa — Fri, 29 Jul 2016 19:49:05 GMT

SSL Version 2 and 3 Protocol Detected
=> Disable SSLv2 and SSLv3, or specify tls1.2
http://docs.splunk.com/Documentation/Splunk/6.4.2/Security/SetyourSSLversion
1. SSL Cert Signed Using Weak Hashing Algorithm (SHA1) => Avoid using Splunk default certificate, and create your own certificate with stronger signiture (sha2 type) asking trusted CA. => openssl has option such as -sha256. For more detail, pleaes consult your trusted CA or google it regarding how to crate certificate with SHA256 or something like that! http://docs.splunk.com/Documentation/Splunk/6.4.2/Security/Howtogetthird-partycertificates
2. SSL Certificate Wrong Hostname (Splunk Self Signed Cert running on 8089) => You need to craete your own certificate and use proper HostName. Splunk default cert does not use server's host name
3. TLS CRIME Vulnerability https://answers.splunk.com/answers/65218/splunk-shows-vulnerable-to-cve-2012-4929-in-my-nessus-vulnerability-scan-what-is-going-on.html

Re: Splunk Enterprise 8089 Vulnerability Scan Results: How do I resolve these SSL errors?

serwin — Fri, 29 Jul 2016 20:09:13 GMT

Awesome!

That's what i was looking for!

Quick question, for 1,2,3 do those fixes apply for stuff on the management port (8089)?

Thanks

Re: Splunk Enterprise 8089 Vulnerability Scan Results: How do I resolve these SSL errors?

Masa — Thu, 04 Aug 2016 23:44:11 GMT

Yes, all of them can apply to the Splunk management port (default is 8089)

Re: Splunk Enterprise 8089 Vulnerability Scan Results: How do I resolve these SSL errors?

syadavsplunk — Wed, 14 Mar 2018 05:42:40 GMT

Thanks . This will be helpful

Re: Splunk Enterprise 8089 Vulnerability Scan Results: How do I resolve these SSL errors?

splunk24 — Thu, 07 Jun 2018 14:56:41 GMT

i am using 6.4..4 and by scaning we got issue on 8008 port as SHA 1 alert
so how to make 8008 port (vmware DCN port) as secure?

Re: Splunk Enterprise 8089 Vulnerability Scan Results: How do I resolve these SSL errors?

usenetim — Wed, 16 Sep 2020 14:39:56 GMT

Is there a version of the Universal forwarder that isn't prone to this issue?