topic Re: TLS between splunk components in Splunk Enterprise

TLS between splunk components

Nawab — Sun, 11 Aug 2024 08:19:23 GMT

We have below deployement, UF ----> HF ----> IDX

Uf are sending data to Hf and Hf is acting as and Intermediatry forwarder between UF and IDX.

Now we want to do TLS b/w splunk components. can we do TLS between HF and IDX and leave UFs.

Will UF data will also be TLS complient?

If not will UF still sends data to IDXs or we will stop receiving logs all together?

Re: TLS between splunk components

VatsalJagani — Mon, 12 Aug 2024 13:15:36 GMT

@Nawab- The answer is yes, you can setup SSL on both places and you can also set SSL only for HF to Indexer.

I think it should not matter what you use from UF to HF and HF to Indexer, they should act independent from each other.

Connection with SSL

inputs.conf --------------- [splunktcp-ssl:9997] serverCert = <string> sslPassword = <string> requireClientCert = <boolean> sslVersions = <string> cipherSuite = <cipher suite string> ecdhCurves = <comma separated list of ec curves> dhFile = <string> allowSslRenegotiation = <boolean> sslQuietShutdown = <boolean> sslCommonNameToCheck = <commonName1>, <commonName2>, ... sslAltNameToCheck = <alternateName1>, <alternateName2>, ... useSSLCompression = <boolean> outputs.conf ------------------ [tcpout] defaultGroup = my_indexers [tcpout:my_indexers] server = <indexer>:9997 sslPassword = password clientCert = $SPLUNK_HOME/etc/auth/server.pem (<Check outputs.conf.spec for other SSL configs)

Connection without SSL

inputs.conf --------------- [splunktcp:9997] outputs.conf ------------------ [tcpout] defaultGroup = my_indexers [tcpout:my_indexers] server = <indexer>:9997

I hope this helps!!!!

Re: TLS between splunk components

Nawab — Sun, 11 Aug 2024 09:24:54 GMT

Thanks for your answer, let me do it and check if it works.

Also why are you doing ssl on inputs.conf as per docs it should be done on outsputs of HF

Re: TLS between splunk components

isoutamo — Sun, 11 Aug 2024 10:46:19 GMT

Here is conf presentation about using TLS with splunk https://conf.splunk.com/files/2023/slides/SEC1936B.pdf