On a Heavy forwarder that forwards events to a 3rd party device, how can I encrypt the traffic using certificates?

pete222 — Wed, 15 Aug 2018 16:09:43 GMT

Hi
I have an app on a HF that forwards events to a 3rd party device via unencrypted channel. I would like to encrypt the traffic using certificates which I received from a 3rd party (root.crt and sender.crt).

This is the output.conf stanza I am trying to use which does not seem to work:

[tcpout:3rdparty]
    server = <IP>:<Port>
    sslRootCAPath = $SPLUNK_HOME/etc/apps/3rdparty/local/root.crt
    sslCertPath = $SPLUNK_HOME/etc/apps/3rdparty/local/sender.crt
    requireClientCert = false
    sslVerifyServerCert = false
    sendCookedData = false

"Error initializing SSL context - check splunkd.log regarding configuration error for server "

What additional steps do I need to take to accomplish this?

Re: On a Heavy forwarder that forwards events to a 3rd party device, how can I encrypt the traffic using certificates?

sudosplunk — Wed, 15 Aug 2018 18:45:01 GMT

What does splunkd.log say about configuration errors? I think the sslPassword setting is missing. Also, you need to configure inputs.conf on your receiver.

The configurations structure which worked for me is,

outputs.conf (on forwarders):

[tcpout]
sslPassword = xxxxxxxxxxxxxxxxxxxxxx
sslVersions = tls1.2
clientCert = $SPLUNK_HOME/etc/auth/myOrg/myOrgFWDcert.pem
sslRootCAPath = $SPLUNK_HOME/etc/auth/myOrg/myOrgCACertificate.pem
channelReapInterval = 60000
channelReapLowater = 10
channelTTL = 300000
dnsResolutionInterval = 300
negotiateNewProtocol = true
socksResolveDNS = false
useClientSSLCompression = true
[tcpout:my_idx_cluster]
server = idx1.com:9998, idx.com2:9998
useACK = true

inputs.conf (On indexers):

[SSL]
serverCert = $SPLUNK_HOME/etc/auth/myOrg/myOrgServerCertificate.pem
sslPassword = xxxxxxxxxxxxxxxxx
sslVersions = tls1.2

[splunktcp-ssl:9998]

Additionally, please refer to these links for more information,
https://docs.splunk.com/Documentation/Splunk/7.1.2/Security/ConfigureSplunkforwardingtousesignedcertificates
https://conf.splunk.com/session/2015/conf2015_DWaddle_DefensePointSecurity_deploying_SplunkSSLBestPractices.pdf

topic On a Heavy forwarder that forwards events to a 3rd party device, how can I encrypt the traffic using certificates? in Getting Data In

On a Heavy forwarder that forwards events to a 3rd party device, how can I encrypt the traffic using certificates?

Re: On a Heavy forwarder that forwards events to a 3rd party device, how can I encrypt the traffic using certificates?