Getting Data In

Is it possible to disable SSL v3 on the universal forwarder?

a212830
Champion

Is there a way to disable SSL v3 on the UFW? I'm getting flagged by security.

brynsmith
Explorer

I changed these settings ages ago, but my Security department wouldn't believe that it was disabled without proof.
I ran an openssl command from a forwarder to test:
openssl s_client -connect splunk-index-dev-01.example.com:9997 -tls1_2
and it worked as expected, giving me standard connection info.
Then I ran the same command for ssl3, and it gave me the same connection info:
openssl s_client -connect splunk-index-dev-01.example.com:9997 -ssl3
Doing the same command with ssl2 on the end showed that it was not enabled for ssl2.

I doublechecked my settings, and I had sslVersions = tls1.2 set in server.conf on the indexer and outputs.conf on the forwarder, and there was no change.
After a great deal of back-and-forth with Splunk tech support, we figured out that we needed to set sslVersions = tls1.2 in inputs.conf on the indexer, and nothing in the forwarder, not in outputs.conf, not in server.conf, nowhere at all on the forwarder, and also take it out of server.conf on the indexer.


ChrisG
Splunk Employee
Splunk Employee

There is documentation of the new (in Splunk Enterprise 6.2) sslVersions keyword in the Securing Splunk Enterprise manual: Configure allowed and restricted SSL versions. It includes information about configuring forwarders and ensuring compatibility with indexers.

a212830
Champion

Also, just want to confirm, the UFW uses SSLv3 by default?

0 Karma

ithangasamy_spl
Splunk Employee
Splunk Employee

This feature is available in 6.2.0 release of the splunk. You can simply set the following property in the server.conf under
[sslConfig]
sslKeysfilePassword = $1$1E552iukpmwZ
sslVersions=*,-ssl2,-ssl3

this will disable ssl2 and sslv3 protocols, of-course you need to set the corresponding property in the indexer side as well to get the forwarder connecting to the indexer

a212830
Champion

So, I need to update the indexers and the forwarders in sync?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...