client connecting issue when only TLS is enabled

[arber]

Hi,

we have an environmet and due to the POODLE vulnerability that was present on port 8089 on the server we have to force the TLS by adding this on server.conf file

sslVersions = tls1.0, tls1.1, tls1.2

the problem is that after the restart of the splunkd none of the servers that were previously connecting on the forwarder management section is showing up, The data are still coming it is just the servers that are not connected anymore.

Any suggestions, it seems like the clients use only sslv3 to connect

Thanks

[cam343]

Hi Arber,
I suspect your seeing is the same problem I'm experiencing at a clients site.
Firstly the client, in the great poodle rush, disabled SSLv3 via server.conf on the indexer.
Unfortunately the syntax they used was incorrect. What they should have used is (as per server.conf documentation):

sslVersions = tls1.2

The problem I am seeing is that when implementing the above directive or even: "sslVersions = tls" Windows clients can not connect to the deployment server, but forwarding data still works...

When running Splunk 6.13 (or anything less than 6.2 actually) the errors logged on the indexer are:
a). Shared Ciphers
b). SSL Version numbers.

So I suspect that while the inbuilt openssl on Splunk 6.13 supports TLS protocol and associated ciphersuites, something else is causing it to fail.
Therefore I suspect upgrading to Splunk 6.2 or greater will resolve the issue.

I'll report back after the upgrade.

[DimasSouza]

Hi there,

did you follow the intructions from Splunkdocs? You have to update your forwarder configuration as well.

http://docs.splunk.com/Documentation/Splunk/latest/Security/ConfigureSplunkforwardingtousethedefault...