topic Re: inputs.conf and outputs.conf for SSL encryption in Getting Data In

inputs.conf and outputs.conf for SSL encryption

chintan_shah — Mon, 23 Oct 2017 22:29:55 GMT

Hi,
Can someone share with me the recent inputs & outputs conf file for SSL encryption? I am having some trouble for securing the connection between forwarder and indexer.

Re: inputs.conf and outputs.conf for SSL encryption

kunalmao — Tue, 24 Oct 2017 03:40:29 GMT

https://answers.splunk.com/answers/397/how-to-configure-ssl-for-forwarding-and-receiving-data.html

just look at this answer, hope it helps.

Please let me know if this solution does not fit you.

Re: inputs.conf and outputs.conf for SSL encryption

gcusello — Tue, 24 Oct 2017 07:33:58 GMT

Hi chintan_shah,
this is an example that I used:
outputs.conf on Forwarders

[tcpout]
defaultGroup = default-autolb-group

[tcpout-server://xx.xxx.xxx.xxx:9997]
[tcpout-server://yy.yyy.yyy.yyy:9997]

[tcpout:default-autolb-group]
server = xx.xxx.xxx.xxx:9997, yy.yyy.yyy.yyy:9997
disabled=false
sslCertPath = $SPLUNK_HOME/etc/auth/server.pem
sslPassword = password
sslRootCAPath = $SPLUNK_HOME/etc/auth/cacert.pem
sslVerifyServerCert = false
useACK=true
disabled = false

inputs.conf on Indexers

[SSL]
serverCert = $SPLUNK_HOME/etc/auth/server.pem
password = password
requireClientCert = false

This is a default configuration that you can modify following https://docs.splunk.com/Documentation/Splunk/7.0.0/Security/AboutsecuringyourSplunkconfigurationwithSSL .
Obvioulsy change password!

Bye.
Giuseppe