Hello, our Nessus scanner show a issue with the 56 bit SSL ciphers which are allowed by the splunk forwarder:
Synopsis: The remote service supports the use of medium strength SSL ciphers. Description The remote host supports the use of SSL ciphers that offer medium strength encryption, which we currently regard as those with key lengths at least 56 bits and less than 112 bits. Note: This is considerably easier to exploit if the attacker is on the same physical network. Solution Reconfigure the affected application if possible to avoid use of medium strength ciphers. Risk Factor: Medium CVSS Base Score 4.3 (CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N) Plugin Output Here is the list of medium strength SSL ciphers supported by the remote server : Medium Strength Ciphers (>= 56-bit and < 112-bit key) SSLv3 ADH-DES-CBC-SHA Kx=DH Au=None Enc=DES(56) Mac=SHA1 TLSv1 ADH-DES-CBC-SHA Kx=DH Au=None Enc=DES(56) Mac=SHA1 The fields above are : {OpenSSL ciphername} Kx={key exchange} Au={authentication} Enc={symmetric encryption method} Mac={message authentication code} {export flag} Plugin Publication Date: 2009/11/23 Plugin Last Modification Date: 2012/04/02
It looks like we can change the inputs.conf:
[SSL]
# default cipher suites that splunk allows. Change this if you wish to increase the security
# of SSL connections, or to lower it if you having trouble connecting to splunk.
cipherSuite = ALL:!aNULL:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM
with some values from OpenSSL as mentioned here: http://www.openssl.org/docs/apps/ciphers.html but I´m unsure about the vaules Splunk would allow here.
Hi,
just an update to make sure current options are set: v7.3+
https://docs.splunk.com/Documentation/Splunk/latest/Security/Ciphersuites
HTH,
Holger
This should fix it:
[SSL] supportSSLV3Only = true cipherSuite = TLSv1+HIGH:!SSLv2:!aNULL:!eNULL:!3DES:@STRENGTH
Also have a look at http://www.splunk.com/view/SP-CAAAHXG. The 5.0.3 release is a security fix which includes a OpenSSL fix.
It should follow the same syntax as:
openssl ciphers -v 'TLSv1+HIGH:!SSLv2:!aNULL:!eNULL:!3DES:@STRENGTH'
There is a SSL section in inputs.conf:
http://docs.splunk.com/Documentation/Splunk/5.0.3/Admin/Inputsconf
This should be changed in server.conf
on an UF, not in inputs.conf
There is such an option in the 5.0.3 manual. Added a link to it.
Hello krugger,
I tried that, but its not working. We already use 5.0.3 as the forwarder but the issue mentioned in my first posting here stay the same (we already restarted the service after changing the settings).
Which file should we change? The default inputs.conf do not have a supportSSLV3Only value in place and the server.conf required to set the values in the
[sslConfig] section rather then [SSL].