Getting Data In

Allow only a specified SSL cipher in the splunk forwarder?

BastianW
Path Finder

Hello, our Nessus scanner show a issue with the 56 bit SSL ciphers which are allowed by the splunk forwarder:


Synopsis: The remote service supports the use of medium strength SSL ciphers.

Description
The remote host supports the use of SSL ciphers that offer medium strength encryption, which we currently regard as those with key lengths at least 56 bits and less than 112 bits.

Note: This is considerably easier to exploit if the attacker is on the same physical network.

Solution
Reconfigure the affected application if possible to avoid use of medium strength ciphers.

Risk Factor: Medium

CVSS Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N)

Plugin Output
Here is the list of medium strength SSL ciphers supported by the remote server :

 Medium Strength Ciphers (>= 56-bit and < 112-bit key)

 SSLv3
 ADH-DES-CBC-SHA Kx=DH Au=None Enc=DES(56) Mac=SHA1 

 TLSv1
 ADH-DES-CBC-SHA Kx=DH Au=None Enc=DES(56) Mac=SHA1 

The fields above are :

 {OpenSSL ciphername}
 Kx={key exchange}
 Au={authentication}
 Enc={symmetric encryption method}
 Mac={message authentication code}
 {export flag}

Plugin Publication Date: 2009/11/23

Plugin Last Modification Date: 2012/04/02



It looks like we can change the inputs.conf:

[SSL]
# default cipher suites that splunk allows. Change this if you wish to increase the security 
# of SSL connections, or to lower it if you having trouble connecting to splunk.
cipherSuite = ALL:!aNULL:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM

with some values from OpenSSL as mentioned here: http://www.openssl.org/docs/apps/ciphers.html but I´m unsure about the vaules Splunk would allow here.

Tags (4)
0 Karma

hsesterhenn_spl
Splunk Employee
Splunk Employee

Hi,

just an update to make sure current options are set: v7.3+

https://docs.splunk.com/Documentation/Splunk/latest/Security/Ciphersuites

HTH,

Holger

0 Karma

krugger
Communicator

This should fix it:

[SSL]
supportSSLV3Only = true
cipherSuite = TLSv1+HIGH:!SSLv2:!aNULL:!eNULL:!3DES:@STRENGTH

Also have a look at http://www.splunk.com/view/SP-CAAAHXG. The 5.0.3 release is a security fix which includes a OpenSSL fix.

It should follow the same syntax as:


openssl ciphers -v 'TLSv1+HIGH:!SSLv2:!aNULL:!eNULL:!3DES:@STRENGTH'

There is a SSL section in inputs.conf:
http://docs.splunk.com/Documentation/Splunk/5.0.3/Admin/Inputsconf

MuS
SplunkTrust
SplunkTrust

This should be changed in server.conf on an UF, not in inputs.conf

krugger
Communicator

There is such an option in the 5.0.3 manual. Added a link to it.

0 Karma

BastianW
Path Finder

Hello krugger,

I tried that, but its not working. We already use 5.0.3 as the forwarder but the issue mentioned in my first posting here stay the same (we already restarted the service after changing the settings).

Which file should we change? The default inputs.conf do not have a supportSSLV3Only value in place and the server.conf required to set the values in the
[sslConfig] section rather then [SSL].

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...