topic Re: Disabling CBC mode ciphers in Monitoring Splunk

Disabling CBC mode ciphers

lal37 — Fri, 16 May 2014 13:32:55 GMT

Hi Team,

SSLv3.0/TLSv1.0 Protocol Weak CBC Mode vulnerability have been identified on Splunk during internal scan.
The internal PA team asked us to upgrade to TLSv1.1 or TLSv1.2,if not possible to upgrade they asked us to disable CBC mode ciphers.
It could be better if you could guide us to fix the issue.strong text

Regards,
Shiva

Re: Disabling CBC mode ciphers

dwaddle — Fri, 16 May 2014 15:05:04 GMT

For Splunkd (port 8089 by default) - the proper setting of cipher suites is in server.conf under the sslConfig stanza, set the cipherSuite option using a valid OpenSSL cipher suite specification. See http://docs.splunk.com/Documentation/Splunk/latest/Admin/Serverconf

For splunkweb, there are similar settings in web.conf.

Re: Disabling CBC mode ciphers

lal37 — Mon, 26 May 2014 04:33:58 GMT

Hi dawadle,

I would like to know how we can replace SSL version to TLS version.
I guess by default splunk is using SSL encryption.
Please advice.

Thanks and Regards,
Shiva

Re: Disabling CBC mode ciphers

hsesterhenn_spl — Mon, 29 Jul 2019 13:04:06 GMT

Just an update to make sure people use the current options: (v7.3+)

https://docs.splunk.com/Documentation/Splunk/latest/Security/Ciphersuites

HTH,

Holger