Getting Data In

Where to put .PEM file after data accepted?

Marco_Develops
Path Finder

Right now I have a Syslog Server Sending me security events. The Syslog server is sending the data with TLS encryption. 

I have the PEM file, so that Splunk can do the three way handshake and accept my data.

My question is, where do I put that .PEM file.

Currently my Inputs.conf file looks like this: 

 

[tcp-ssl:520]
serverCert = $SPLUNK_HOME/etc/auth/mycerts/myCert.pem
sslPassword = PASSWORD

 

My Server.conf file looks like this: 

 

[sslConfig]
enableSplunkdSSL = true
sslPassword = $**************************
sslRootCAPath = $SPLUNK_HOME/etc/auth/mycerts/myCert.pem

 

My certificate is stored in C:\Program Files\Splunk\etc\auth\mycerts


What am I missing? Any help is appreciated

Thank you,

Marco

Labels (3)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Either your cert is your cert or CA's cert. If you're not authenticating your peer you don't need CA cert anyway.

3-way handshake is in TCP layer. TLS negotiation is a bit more complicated.

Did you restart your splunkd process? Did you check log for errors (for example mistyped filenames or wrong file permissions)? Is splunkd listening on port 520? (Bonus hint - if your process is running with a non-root user it won't bind to low port) Did you try to connect with openssl client?

0 Karma

Marco_Develops
Path Finder

Hi @PickleRick

Thank you for the clarification on the certs. I believe what I am doing is incorrect so my question is:

If you had to send data from a server via TCP-TLS to Splunk. Where would you start? 

Thank You,

Marco

0 Karma

PickleRick
SplunkTrust
SplunkTrust

For tcp-ssl input you define a tcp-ssl stanza.

As a minimum, if you have unencrypted cryptographic material, it's enough to do, for example

[tcp-ssl:1514]
serverCert=$SPLUNK_HOME/etc/certs/whatever.pem
index=my_index
sourcetype=my_sourcetype

As I wrote before, remember that if you're running splunk as a normal user (non-root), you won't be able to bind to a low (<1024) port.

After defining such input, do a restart of your forwarder, verify that it's listening on the port and try to connect from remote with openssl s_client.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...