Universal Forwarder authentication

[bbegyperkspot]

Our use case is to have our Splunk indexer(s) running in one DC and our production hardware in another, in the public cloud at Rackspace, or in the public cloud at Amazon.

So restricting port 9997 to only a whitelist of IPs seems impractical. we can open the port to the internet at large, and SSL encrypt traffic (I think), but how to we authenticate that forwarders as legitimate senders?

If this is documented someplace I have been too dense to find, please let me know.

[churyn_splunk]

You can use tokens: https://docs.splunk.com/Documentation/Forwarder/6.4.1/Forwarder/Controlforwarderaccess

[Ayn · Accepted solution]

There is no authentication mechanism within the session itself. You can, however, make use of SSL's authentication mechanisms in order to achieve this. Specifically by putting client certificates on your forwarders and telling the indexers to verify client certificates when an SSL connection is established, you would have authentication of your forwarders. More information is available here: http://docs.splunk.com/Documentation/Splunk/6.1.2/Security/ConfigureSplunkforwardingtousesignedcerti...

[JeremyHagan]

I've reviewed the doco for this and have to say that I am unimpressed. The private key is stored on the file system and the password for the key is in clear text in a config file. I'd hardly call this secure.