Getting Data In

Allow only a specified SSL cipher in the splunk forwarder?

Path Finder

Hello, our Nessus scanner show a issue with the 56 bit SSL ciphers which are allowed by the splunk forwarder:


Synopsis: The remote service supports the use of medium strength SSL ciphers.

Description
The remote host supports the use of SSL ciphers that offer medium strength encryption, which we currently regard as those with key lengths at least 56 bits and less than 112 bits.

Note: This is considerably easier to exploit if the attacker is on the same physical network.

Solution
Reconfigure the affected application if possible to avoid use of medium strength ciphers.

Risk Factor: Medium

CVSS Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N)

Plugin Output
Here is the list of medium strength SSL ciphers supported by the remote server :

 Medium Strength Ciphers (>= 56-bit and < 112-bit key)

 SSLv3
 ADH-DES-CBC-SHA Kx=DH Au=None Enc=DES(56) Mac=SHA1 

 TLSv1
 ADH-DES-CBC-SHA Kx=DH Au=None Enc=DES(56) Mac=SHA1 

The fields above are :

 {OpenSSL ciphername}
 Kx={key exchange}
 Au={authentication}
 Enc={symmetric encryption method}
 Mac={message authentication code}
 {export flag}

Plugin Publication Date: 2009/11/23

Plugin Last Modification Date: 2012/04/02



It looks like we can change the inputs.conf:

[SSL]
# default cipher suites that splunk allows. Change this if you wish to increase the security 
# of SSL connections, or to lower it if you having trouble connecting to splunk.
cipherSuite = ALL:!aNULL:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM

with some values from OpenSSL as mentioned here: http://www.openssl.org/docs/apps/ciphers.html but I´m unsure about the vaules Splunk would allow here.

Tags (4)
0 Karma

Splunk Employee
Splunk Employee

Hi,

just an update to make sure current options are set: v7.3+

https://docs.splunk.com/Documentation/Splunk/latest/Security/Ciphersuites

HTH,

Holger

0 Karma

Communicator

This should fix it:

[SSL]
supportSSLV3Only = true
cipherSuite = TLSv1+HIGH:!SSLv2:!aNULL:!eNULL:!3DES:@STRENGTH

Also have a look at http://www.splunk.com/view/SP-CAAAHXG. The 5.0.3 release is a security fix which includes a OpenSSL fix.

It should follow the same syntax as:


openssl ciphers -v 'TLSv1+HIGH:!SSLv2:!aNULL:!eNULL:!3DES:@STRENGTH'

There is a SSL section in inputs.conf:
http://docs.splunk.com/Documentation/Splunk/5.0.3/Admin/Inputsconf

SplunkTrust
SplunkTrust

This should be changed in server.conf on an UF, not in inputs.conf

Communicator

There is such an option in the 5.0.3 manual. Added a link to it.

0 Karma

Path Finder

Hello krugger,

I tried that, but its not working. We already use 5.0.3 as the forwarder but the issue mentioned in my first posting here stay the same (we already restarted the service after changing the settings).

Which file should we change? The default inputs.conf do not have a supportSSLV3Only value in place and the server.conf required to set the values in the
[sslConfig] section rather then [SSL].

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!