Getting Data In

Is it possible to disable SSL v3 on the universal forwarder?

a212830
Champion

Is there a way to disable SSL v3 on the UFW? I'm getting flagged by security.

brynsmith
Explorer

I changed these settings ages ago, but my Security department wouldn't believe that it was disabled without proof.
I ran an openssl command from a forwarder to test:
openssl s_client -connect splunk-index-dev-01.example.com:9997 -tls1_2
and it worked as expected, giving me standard connection info.
Then I ran the same command for ssl3, and it gave me the same connection info:
openssl s_client -connect splunk-index-dev-01.example.com:9997 -ssl3
Doing the same command with ssl2 on the end showed that it was not enabled for ssl2.

I doublechecked my settings, and I had sslVersions = tls1.2 set in server.conf on the indexer and outputs.conf on the forwarder, and there was no change.
After a great deal of back-and-forth with Splunk tech support, we figured out that we needed to set sslVersions = tls1.2 in inputs.conf on the indexer, and nothing in the forwarder, not in outputs.conf, not in server.conf, nowhere at all on the forwarder, and also take it out of server.conf on the indexer.


ChrisG
Splunk Employee
Splunk Employee

There is documentation of the new (in Splunk Enterprise 6.2) sslVersions keyword in the Securing Splunk Enterprise manual: Configure allowed and restricted SSL versions. It includes information about configuring forwarders and ensuring compatibility with indexers.

a212830
Champion

Also, just want to confirm, the UFW uses SSLv3 by default?

0 Karma

ithangasamy_spl
Splunk Employee
Splunk Employee

This feature is available in 6.2.0 release of the splunk. You can simply set the following property in the server.conf under
[sslConfig]
sslKeysfilePassword = $1$1E552iukpmwZ
sslVersions=*,-ssl2,-ssl3

this will disable ssl2 and sslv3 protocols, of-course you need to set the corresponding property in the indexer side as well to get the forwarder connecting to the indexer

a212830
Champion

So, I need to update the indexers and the forwarders in sync?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...