Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- sslKeysfilePassword not working in a deployed forw...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
sslKeysfilePassword not working in a deployed forwarder app
I've created some certificates to use with our forwarders to secure forwarded traffic. I've created an indexer_discovery app which contains outputs, a cert directory containing my certificate etc. but I've hit a snag...
I also included app/local/server.conf with an [sslConfig] stanza containing the cert location, sslKeysfilePassword etc. but Splunk doesn't seem to read the password from this file. After a forwarder restart the password remains unencrypted and the forwarder can't decrypt the cert producing lots of errors in splunkd.log.
The only workaround is to modify /opt/splunkforwarder/etc/system/local/server.conf and add [sslConfig] with the sslKeysfilePassword parameter. This means when we deploy the indexer discovery app we'll also need to login to each server to change the local server.conf file.
Please tell me I'm doing it wrong 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You are indeed doing it wrong 🙂
The forwarder SSL doesn't use the server.conf file - it uses inputs.conf & outputs.conf.
First go and read dwaddles SSL guides:
http://www.duanewaddle.com/splunk-conf-2014/
The relevant splunk documentation is here:
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm not saying you're wrong but if you are correct then why does SSL forwarding work when I move the sslKeysfilePassword parameter to etc/system/local/server.conf? I can confirm that it also uses the cert we've pushed down with the app along with the cert location in server.conf within the app context.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Odd - I don't actually use the SSL forwarding myself, so I couldn't tell you for sure. My guess would be that when you put the parameter in system/local it gets ignored
On your indexer run ./bin/splunk cmd btool inputs list
If you're using ssl you should have an input stanza like [splunktcp-ssl:9997]. If its [splunktcp://9997] then you're not actually using SSL
The server.conf controls the ssl settings for the splunkd port, 8089
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
