topic Re: Working on Securing Data with SSL between Heavy Forwarder and Universal Forwarder using default certificates in Getting Data In

Working on Securing Data with SSL between Heavy Forwarder and Universal Forwarder using default certificates

YusufK — Thu, 15 Oct 2020 22:04:16 GMT

Hi, I am having trouble attempting to get a deployment server and a deployment client to communicate and then access data through the Splunk search using SSL with Splunk default certificates. What steps would I have to go through to achieve this? So I am trying to get my deployment server A with default certs cacert.pem and server.pem in /etc/auth to communicate with Server B which also has the same default certs in /etc/auth.

I have defined the Deployment Server server.conf and inputs.conf as shown:

[sslConfig]

enableSplunkdSSL = false
useClientSSLCompression = true
serverCert = /xxxxx/splunk/etc/auth/server.pem
sslPassword = password
sslRootCAPath = /xxxx/splunk/etc/auth/cacert.pem
certCreateScript = genMyServerCert.sh

inputs.conf

[SSL]
serverCert = /xxxx/splunk/etc/auth/server.pem
password = password
rootCA = /xxxx/splunk/etc/auth/cacert.pem
requireClientCert = false
sslVersions = tls,-ssl3

On my Server B or Deployment Client, my server.conf is defined as

[sslConfig]

enableSplunkdSSL = true
[default]
useClientSSLCompression = true
serverCert = /xxxx/splunkforwarder/etc/auth/server.pem
sslPassword = password
sslRootCAPath = /xxxx/splunkforwarder/etc/auth/cacert.pem
certCreateScript = genMyServerCert.sh

What .conf files do I need to edit and what stanzas will I need to define on the Deployment Client(server B) for them to communicate and eventually I can search Server B on my search head? Sorry if this is unclear but I will be answering any questions on what I am asking.

Thank you.

Re: Working on Securing Data with SSL between Heavy Forwarder and Universal Forwarder using default certificates

inventsekar — Thu, 15 Oct 2020 22:46:12 GMT

Hi @YusufK the question heading says about heavy forwarder.. do you want SSL between

UF--->HF--->indexer

Deployment Server <---> UF

(for this, hope you referred the documentation https://docs.splunk.com/Documentation/Splunk/8.0.6/Security/Securingyourdeploymentserverandclients )

Re: Working on Securing Data with SSL between Heavy Forwarder and Universal Forwarder using default certificates

YusufK — Thu, 15 Oct 2020 23:29:27 GMT

Hi I am looking for

Deployment Server <---> UF

For example, Server A is my Deployment Server AND Heavy Forwarder. Server B is my Deployment Client. I would like them to communicate with the default cert, and I would like searchable results in the search bar for Server B.

Thank you.