Getting Data In

Allow only a specified SSL cipher in the splunk forwarder?

Path Finder

Hello, our Nessus scanner show a issue with the 56 bit SSL ciphers which are allowed by the splunk forwarder:

Synopsis: The remote service supports the use of medium strength SSL ciphers.

The remote host supports the use of SSL ciphers that offer medium strength encryption, which we currently regard as those with key lengths at least 56 bits and less than 112 bits.

Note: This is considerably easier to exploit if the attacker is on the same physical network.

Reconfigure the affected application if possible to avoid use of medium strength ciphers.

Risk Factor: Medium

CVSS Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N)

Plugin Output
Here is the list of medium strength SSL ciphers supported by the remote server :

 Medium Strength Ciphers (>= 56-bit and < 112-bit key)

 ADH-DES-CBC-SHA Kx=DH Au=None Enc=DES(56) Mac=SHA1 

 ADH-DES-CBC-SHA Kx=DH Au=None Enc=DES(56) Mac=SHA1 

The fields above are :

 {OpenSSL ciphername}
 Kx={key exchange}
 Enc={symmetric encryption method}
 Mac={message authentication code}
 {export flag}

Plugin Publication Date: 2009/11/23

Plugin Last Modification Date: 2012/04/02

It looks like we can change the inputs.conf:

# default cipher suites that splunk allows. Change this if you wish to increase the security 
# of SSL connections, or to lower it if you having trouble connecting to splunk.

with some values from OpenSSL as mentioned here: but I´m unsure about the vaules Splunk would allow here.

Tags (4)
0 Karma

Splunk Employee
Splunk Employee


just an update to make sure current options are set: v7.3+



0 Karma


This should fix it:

supportSSLV3Only = true
cipherSuite = TLSv1+HIGH:!SSLv2:!aNULL:!eNULL:!3DES:@STRENGTH

Also have a look at The 5.0.3 release is a security fix which includes a OpenSSL fix.

It should follow the same syntax as:

openssl ciphers -v 'TLSv1+HIGH:!SSLv2:!aNULL:!eNULL:!3DES:@STRENGTH'

There is a SSL section in inputs.conf:


This should be changed in server.conf on an UF, not in inputs.conf


There is such an option in the 5.0.3 manual. Added a link to it.

0 Karma

Path Finder

Hello krugger,

I tried that, but its not working. We already use 5.0.3 as the forwarder but the issue mentioned in my first posting here stay the same (we already restarted the service after changing the settings).

Which file should we change? The default inputs.conf do not have a supportSSLV3Only value in place and the server.conf required to set the values in the
[sslConfig] section rather then [SSL].

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!