Allow only a specified SSL cipher in the splunk forwarder?

[BastianW]

Hello, our Nessus scanner show a issue with the 56 bit SSL ciphers which are allowed by the splunk forwarder:

---

Synopsis: The remote service supports the use of medium strength SSL ciphers.

Description
The remote host supports the use of SSL ciphers that offer medium strength encryption, which we currently regard as those with key lengths at least 56 bits and less than 112 bits.

Note: This is considerably easier to exploit if the attacker is on the same physical network.

Solution
Reconfigure the affected application if possible to avoid use of medium strength ciphers.

Risk Factor: Medium

CVSS Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N)

Plugin Output
Here is the list of medium strength SSL ciphers supported by the remote server :

 Medium Strength Ciphers (>= 56-bit and < 112-bit key)

 SSLv3
 ADH-DES-CBC-SHA Kx=DH Au=None Enc=DES(56) Mac=SHA1 

 TLSv1
 ADH-DES-CBC-SHA Kx=DH Au=None Enc=DES(56) Mac=SHA1 

The fields above are :

 {OpenSSL ciphername}
 Kx={key exchange}
 Au={authentication}
 Enc={symmetric encryption method}
 Mac={message authentication code}
 {export flag}

Plugin Publication Date: 2009/11/23

Plugin Last Modification Date: 2012/04/02


---

It looks like we can change the inputs.conf:

[SSL]
# default cipher suites that splunk allows. Change this if you wish to increase the security 
# of SSL connections, or to lower it if you having trouble connecting to splunk.
cipherSuite = ALL:!aNULL:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM

with some values from OpenSSL as mentioned here: http://www.openssl.org/docs/apps/ciphers.html but I´m unsure about the vaules Splunk would allow here.

[hsesterhenn_spl]

Hi,

just an update to make sure current options are set: v7.3+

https://docs.splunk.com/Documentation/Splunk/latest/Security/Ciphersuites

HTH,

Holger

[krugger]

This should fix it:

[SSL]
supportSSLV3Only = true
cipherSuite = TLSv1+HIGH:!SSLv2:!aNULL:!eNULL:!3DES:@STRENGTH

Also have a look at http://www.splunk.com/view/SP-CAAAHXG. The 5.0.3 release is a security fix which includes a OpenSSL fix.

It should follow the same syntax as:

openssl ciphers -v 'TLSv1+HIGH:!SSLv2:!aNULL:!eNULL:!3DES:@STRENGTH'

There is a SSL section in inputs.conf:
http://docs.splunk.com/Documentation/Splunk/5.0.3/Admin/Inputsconf

[MuS]

This should be changed in server.conf on an UF, not in inputs.conf

[krugger]

There is such an option in the 5.0.3 manual. Added a link to it.

[BastianW]

Hello krugger,

I tried that, but its not working. We already use 5.0.3 as the forwarder but the issue mentioned in my first posting here stay the same (we already restarted the service after changing the settings).

Which file should we change? The default inputs.conf do not have a supportSSLV3Only value in place and the server.conf required to set the values in the
[sslConfig] section rather then [SSL].