Getting Data In

Is it possible to disable SSL v3 on the universal forwarder?


Is there a way to disable SSL v3 on the UFW? I'm getting flagged by security.


I changed these settings ages ago, but my Security department wouldn't believe that it was disabled without proof.
I ran an openssl command from a forwarder to test:
openssl s_client -connect -tls1_2
and it worked as expected, giving me standard connection info.
Then I ran the same command for ssl3, and it gave me the same connection info:
openssl s_client -connect -ssl3
Doing the same command with ssl2 on the end showed that it was not enabled for ssl2.

I doublechecked my settings, and I had sslVersions = tls1.2 set in server.conf on the indexer and outputs.conf on the forwarder, and there was no change.
After a great deal of back-and-forth with Splunk tech support, we figured out that we needed to set sslVersions = tls1.2 in inputs.conf on the indexer, and nothing in the forwarder, not in outputs.conf, not in server.conf, nowhere at all on the forwarder, and also take it out of server.conf on the indexer.

Splunk Employee
Splunk Employee

There is documentation of the new (in Splunk Enterprise 6.2) sslVersions keyword in the Securing Splunk Enterprise manual: Configure allowed and restricted SSL versions. It includes information about configuring forwarders and ensuring compatibility with indexers.


Also, just want to confirm, the UFW uses SSLv3 by default?

0 Karma

Splunk Employee
Splunk Employee

This feature is available in 6.2.0 release of the splunk. You can simply set the following property in the server.conf under
sslKeysfilePassword = $1$1E552iukpmwZ

this will disable ssl2 and sslv3 protocols, of-course you need to set the corresponding property in the indexer side as well to get the forwarder connecting to the indexer


So, I need to update the indexers and the forwarders in sync?

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...