Getting Data In
Highlighted

Is it possible to disable SSL v3 on the universal forwarder?

Champion

Is there a way to disable SSL v3 on the UFW? I'm getting flagged by security.

Highlighted

Re: Is it possible to disable SSL v3 on the universal forwarder?

Splunk Employee
Splunk Employee

This feature is available in 6.2.0 release of the splunk. You can simply set the following property in the server.conf under
[sslConfig]
sslKeysfilePassword = $1$1E552iukpmwZ
sslVersions=*,-ssl2,-ssl3

this will disable ssl2 and sslv3 protocols, of-course you need to set the corresponding property in the indexer side as well to get the forwarder connecting to the indexer

Highlighted

Re: Is it possible to disable SSL v3 on the universal forwarder?

Champion

So, I need to update the indexers and the forwarders in sync?

0 Karma
Highlighted

Re: Is it possible to disable SSL v3 on the universal forwarder?

Splunk Employee
Splunk Employee

There is documentation of the new (in Splunk Enterprise 6.2) sslVersions keyword in the Securing Splunk Enterprise manual: Configure allowed and restricted SSL versions. It includes information about configuring forwarders and ensuring compatibility with indexers.

Highlighted

Re: Is it possible to disable SSL v3 on the universal forwarder?

Champion

Also, just want to confirm, the UFW uses SSLv3 by default?

0 Karma
Highlighted

Re: Is it possible to disable SSL v3 on the universal forwarder?

Explorer

I changed these settings ages ago, but my Security department wouldn't believe that it was disabled without proof.
I ran an openssl command from a forwarder to test:
openssl sclient -connect splunk-index-dev-01.example.com:9997 -tls12
and it worked as expected, giving me standard connection info.
Then I ran the same command for ssl3, and it gave me the same connection info:
openssl s_client -connect splunk-index-dev-01.example.com:9997 -ssl3
Doing the same command with ssl2 on the end showed that it was not enabled for ssl2.

I doublechecked my settings, and I had sslVersions = tls1.2 set in server.conf on the indexer and outputs.conf on the forwarder, and there was no change.
After a great deal of back-and-forth with Splunk tech support, we figured out that we needed to set sslVersions = tls1.2 in inputs.conf on the indexer, and nothing in the forwarder, not in outputs.conf, not in server.conf, nowhere at all on the forwarder, and also take it out of server.conf on the indexer.