topic sslKeysfilePassword not working in a deployed forwarder app in Getting Data In

sslKeysfilePassword not working in a deployed forwarder app

stepheneardley — Wed, 13 Jul 2016 14:11:16 GMT

I've created some certificates to use with our forwarders to secure forwarded traffic. I've created an indexer_discovery app which contains outputs, a cert directory containing my certificate etc. but I've hit a snag...

I also included app/local/server.conf with an [sslConfig] stanza containing the cert location, sslKeysfilePassword etc. but Splunk doesn't seem to read the password from this file. After a forwarder restart the password remains unencrypted and the forwarder can't decrypt the cert producing lots of errors in splunkd.log.

The only workaround is to modify /opt/splunkforwarder/etc/system/local/server.conf and add [sslConfig] with the sslKeysfilePassword parameter. This means when we deploy the indexer discovery app we'll also need to login to each server to change the local server.conf file.

Please tell me I'm doing it wrong 🙂

Re: sslKeysfilePassword not working in a deployed forwarder app

jplumsdaine22 — Wed, 13 Jul 2016 15:53:55 GMT

You are indeed doing it wrong 🙂

The forwarder SSL doesn't use the server.conf file - it uses inputs.conf & outputs.conf.

First go and read dwaddles SSL guides:
http://www.duanewaddle.com/splunk-conf-2014/

The relevant splunk documentation is here:

http://docs.splunk.com/Documentation/Splunk/6.4.2/Security/ConfigureSplunkforwardingtousesignedcertificates

Re: sslKeysfilePassword not working in a deployed forwarder app

stepheneardley — Fri, 15 Jul 2016 13:48:49 GMT

I'm not saying you're wrong but if you are correct then why does SSL forwarding work when I move the sslKeysfilePassword parameter to etc/system/local/server.conf? I can confirm that it also uses the cert we've pushed down with the app along with the cert location in server.conf within the app context.

Re: sslKeysfilePassword not working in a deployed forwarder app

jplumsdaine22 — Fri, 15 Jul 2016 16:07:44 GMT

Odd - I don't actually use the SSL forwarding myself, so I couldn't tell you for sure. My guess would be that when you put the parameter in system/local it gets ignored

On your indexer run ./bin/splunk cmd btool inputs list

If you're using ssl you should have an input stanza like [splunktcp-ssl:9997]. If its [splunktcp://9997] then you're not actually using SSL

The server.conf controls the ssl settings for the splunkd port, 8089