topic Re: Is it possible to disable SSL v3 on the universal forwarder? in Getting Data In

Is it possible to disable SSL v3 on the universal forwarder?

a212830 — Tue, 28 Oct 2014 13:38:41 GMT

Is there a way to disable SSL v3 on the UFW? I'm getting flagged by security.

Re: Is it possible to disable SSL v3 on the universal forwarder?

ithangasamy_spl — Tue, 28 Oct 2014 15:03:52 GMT

This feature is available in 6.2.0 release of the splunk. You can simply set the following property in the server.conf under
[sslConfig]
sslKeysfilePassword = $1$1E552iukpmwZ
sslVersions=*,-ssl2,-ssl3

this will disable ssl2 and sslv3 protocols, of-course you need to set the corresponding property in the indexer side as well to get the forwarder connecting to the indexer

Re: Is it possible to disable SSL v3 on the universal forwarder?

ChrisG — Tue, 28 Oct 2014 15:27:58 GMT

There is documentation of the new (in Splunk Enterprise 6.2) sslVersions keyword in the Securing Splunk Enterprise manual: Configure allowed and restricted SSL versions. It includes information about configuring forwarders and ensuring compatibility with indexers.

Re: Is it possible to disable SSL v3 on the universal forwarder?

a212830 — Tue, 28 Oct 2014 17:30:58 GMT

So, I need to update the indexers and the forwarders in sync?

Re: Is it possible to disable SSL v3 on the universal forwarder?

a212830 — Tue, 28 Oct 2014 17:35:36 GMT

Also, just want to confirm, the UFW uses SSLv3 by default?

Re: Is it possible to disable SSL v3 on the universal forwarder?

brynsmith — Tue, 29 Sep 2020 12:32:30 GMT

I changed these settings ages ago, but my Security department wouldn't believe that it was disabled without proof.
I ran an openssl command from a forwarder to test:
openssl s_client -connect splunk-index-dev-01.example.com:9997 -tls1_2
and it worked as expected, giving me standard connection info.
Then I ran the same command for ssl3, and it gave me the same connection info:
openssl s_client -connect splunk-index-dev-01.example.com:9997 -ssl3
Doing the same command with ssl2 on the end showed that it was not enabled for ssl2.

I doublechecked my settings, and I had sslVersions = tls1.2 set in server.conf on the indexer and outputs.conf on the forwarder, and there was no change.
After a great deal of back-and-forth with Splunk tech support, we figured out that we needed to set sslVersions = tls1.2 in inputs.conf on the indexer, and nothing in the forwarder, not in outputs.conf, not in server.conf, nowhere at all on the forwarder, and also take it out of server.conf on the indexer.