Getting Data In

Simple forwarder encryption

defaultdeny
Engager

Is it possible to configure a universal forwarder to encrypt WITHOUT requiring mutual auth? Like how most browsers work with HTTPS sites? Don't need to authenticate the client just prevent eavesdropping.

Tags (2)

starcher
Influencer

dwaddle
SplunkTrust
SplunkTrust

Yes and no. Total agreement that useSSL=1 would be ideal. When a forwarder is set up to use SSL, providing a certificate to authenticate with is the only way to enable SSL. BUT, the indexer-side's inputs.conf decides whether a client certificate is actually needed to authenticate or not. I would like to see the forwarder side decouple "I would like to use SSL" from "Here is my client certificate"...

Also Brian rocks.

ebaileytu
Communicator

plus 1 - on useSSL=1 managing certs in a large forwarder environment is not much fun

0 Karma

defaultdeny
Engager

This does not answer my question. Question was answered via IRC by bosburn. The answer is that Splunk does not support this simple mode of encryption. I propose that this feature be added. Something like UseSSL = 1 instead of having to drop a client cert and configure a password on all end-points.

Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...