Encryption on ports 9997 and 8089

[damucka]

Hello,

I have a question concerning encryption.
- Is the log transmission over the port 9997 per default encrypted?
- The same for the port 8089, if I use it to access the Splunk from Python over the 8089, is the data encrypted per default?

Kind Regards,
Kamil

[harsmarvania57 · Accepted solution]

Hi,

Have a look at table on Splunk doc https://docs.splunk.com/Documentation/Splunk/7.2.5/Security/AboutsecuringyourSplunkconfigurationwith...

[damucka]

Hello @harsmarvania57

Thank you for the prompt answer. It helped to clarify and prepare the encryption for the forwarder --> indexer log transfer.
With the second question I still would need a help. If I connect to the Splunk using the splunk-python-sdk like below:

import sys
import splunklib.client as client

HOST = "splunk.mo.sap.corp"
PORT = 8089
USERNAME = "XXX"
PASSWORD = "YYY"
#searchQuery = "SSS"


# Create a Service instance and log in 
service = client.connect(
    host=HOST,
    port=PORT,
    username=USERNAME,
    password=PASSWORD)

...

Would the communication over port 8089 be encrypted in this case?

Kind Regards,
Kamil

[harsmarvania57]

If you look at "Type of Exchange" -> "Distributed search" in that splunk document it says on splunkd (Which means port 8089) encryption is enabled by default but cert authentication is not enabled by default and due to this we can say that this connection is not encrypted if you don't have correct certificate on client.

When you don't have correct certificate chain present on client side, it will try to encrypt connection when you connect from client to server but by default splunk will strictly not check certificate validation and you can connect to splunkd and that communication is not encrypted as per my knowledge.