topic How to valite/remediate RC4 ciphers within Splunk? in Deployment Architecture

How to valite/remediate RC4 ciphers within Splunk?

a212830 — Fri, 02 Feb 2018 15:15:10 GMT

Hi,

One of our Splunk servers was flagged for using RC4 ciphers. How can I validate and then disable this option within Splunk? We are using 6.5.4..

a212830 — Mon, 05 Feb 2018 14:35:11 GMT

Anyone?

harsmarvania57 — Mon, 05 Feb 2018 15:07:33 GMT

Hi @a212830,

If you run below command on splunk then it will display that RC4 is present in SSLv3 only.

$SPLUNK_HOME/bin/splunk cmd openssl ciphers -v | grep RC4

So based on that if SSLv3 is not require then you can disable SSLv3 in 3 different files.

For management port (Default port 8089) -> server.conf , under [sslConfig] stanza you can define sslVersions = *, -ssl2, -ssl3
For receiver port (Indexer, Default port 9997) -> inputs.conf, under [SSL] stanza you can define sslVersions = *, -ssl2, -ssl3
For splunkweb port (Default port 8000) -> web.conf, under [settings] stanza you can define sslVersions = *, -ssl2, -ssl3

sloshburch — Tue, 06 Feb 2018 13:12:09 GMT

@a212830 - Would you accept this answer if it helped?

a212830 — Wed, 14 Feb 2018 12:42:08 GMT

Done.

Hi Burch!