Getting Data In

Splunk DB Connect: Why can't I get java bridge to run after configuring splunkd to use SSL with syntax copied from the release notes?

sjh65
Explorer

After configuring splunkd to use SSL, with

/etc/system/local/server.conf

[sslConfig]
enableSplunkdSSL = true
sslVersions = <*, -sslv2 , -sslv3>

I wasn't able to get the java bridge to run with the syntax copied from the release notes or even just TLSv1 in the <> I instead had to use sslVersion*s* and the same syntax that i used in the server.conf file to get the jbridge to start up again.

/etc/apps/dbx/local/java.conf

[splunkd]
sslVersions = <*, -sslv2 , -sslv3>
#sslVersion = <SSLv3, TLSv1>

The release notes for 1.1.16

The Java Bridge Server can now use either SSL or TLS for security encryption when connecting to splunkd. Both are enabled by default. To specify one or the other, edit the following lines in dbx/local/java.conf:

[splunkd]
sslVersion = < SSLv3, TLSv1 >

This fixes the problem that arose when a user set the encryption scheme to TLS in /etc/system/local/server.conf to avoid the SSL >POODLE vulnerability. (DBX-1025)

with a snippet from the jbridge.log when using plain

Exception in thread "main" java.lang.IllegalArgumentException: <TLSv1>    at sun.security.ssl.ProtocolVersion.valueOf(ProtocolVersion.java:164)   at sun.security.ssl.ProtocolList.convert(ProtocolList.java:84)      at sun.security.ssl.ProtocolList.<init>(ProtocolList.java:52)       at sun.security.ssl.SSLSocketImpl.setEnabledProtocols(SSLSocketImpl.java:2394)      at com.splunk.rest.Splunkd$SSLSocketFactoryImpl.configure(Splunkd.java:288)         at com.splunk.rest.Splunkd$SSLSocketFactoryImpl.createSocket(Splunkd.java:313)      at sun.net.www.protocol.https.HttpsClient.createSocket(HttpsClient.java:409)        at sun.net.NetworkClient.doConnect(NetworkClient.java:162)      at sun.net.www.http.HttpClient.openServer(HttpClient.java:432)

So I guess the question is, do the release notes have the syntax wrong?

0 Karma
1 Solution

mtevenan_splunk
Splunk Employee
Splunk Employee

Hi there. I'm the writer for this documentation. Apologies for the confusion. The "< >" syntax is supposed to indicate that you should choose one of the values between the "< >" symbols, but I realize that many folks are going to be copying and pasting. I've updated the page to make it more clear what syntax you should use.

Thanks for the feedback!
Matt Tevenan

View solution in original post

mtevenan_splunk
Splunk Employee
Splunk Employee

Hi there. I'm the writer for this documentation. Apologies for the confusion. The "< >" syntax is supposed to indicate that you should choose one of the values between the "< >" symbols, but I realize that many folks are going to be copying and pasting. I've updated the page to make it more clear what syntax you should use.

Thanks for the feedback!
Matt Tevenan

hansdi
New Member

I had a similar issue recently. After some trial and error, the stanza that worked for me (bear in mind I wanted to use a specific version of TLS) was:

[splunkd]
sslVersion = TLSv1.2

I agree it is not ideal for the parameter to be called sslVersions in some conf files and sslVersion in the app conf file.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...