Getting Data In

Universal Forwarder authentication

bbegyperkspot
Explorer

Our use case is to have our Splunk indexer(s) running in one DC and our production hardware in another, in the public cloud at Rackspace, or in the public cloud at Amazon.

So restricting port 9997 to only a whitelist of IPs seems impractical. we can open the port to the internet at large, and SSL encrypt traffic (I think), but how to we authenticate that forwarders as legitimate senders?

If this is documented someplace I have been too dense to find, please let me know.

0 Karma
1 Solution

Ayn
Legend

There is no authentication mechanism within the session itself. You can, however, make use of SSL's authentication mechanisms in order to achieve this. Specifically by putting client certificates on your forwarders and telling the indexers to verify client certificates when an SSL connection is established, you would have authentication of your forwarders. More information is available here: http://docs.splunk.com/Documentation/Splunk/6.1.2/Security/ConfigureSplunkforwardingtousesignedcerti...

View solution in original post

0 Karma

Ayn
Legend

There is no authentication mechanism within the session itself. You can, however, make use of SSL's authentication mechanisms in order to achieve this. Specifically by putting client certificates on your forwarders and telling the indexers to verify client certificates when an SSL connection is established, you would have authentication of your forwarders. More information is available here: http://docs.splunk.com/Documentation/Splunk/6.1.2/Security/ConfigureSplunkforwardingtousesignedcerti...

0 Karma

JeremyHagan
Communicator

I've reviewed the doco for this and have to say that I am unimpressed. The private key is stored on the file system and the password for the key is in clear text in a config file. I'd hardly call this secure.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...