Enabling FIPS Mode (FIPS 140-2) on Splunk. How to determine which ciphers are used?


We're planning to purchase Splunk (v8.0.6) and Splunk ES (v6.2) shortly, and have a requirement to enable FIPS Mode in order to meet government regulations. We'll be following the directions from this Splunk doc here: 

Once we're running on FIPS 140-2, how do we determine which cipher is being used?

Labels (1)
Tags (1)
0 Karma

Splunk Employee
Splunk Employee

In general, you don't have to worry about the specific algorithm(s) being used for a TLS connection. By installing Splunk with FIPS mode enabled, you'll be installing FIPS-compliant cryptographic modules. This means that ciphers that are disallowed by FIPS won't be an option in the negotiation process that occurs between client and server during the TLS handshake. If you'd like to see which ciphers are available, you can use the openssl "ciphers" command (splunk cmd openssl ciphers) to see which are available on your system. Testing a connection to another node (say, a UF to an indexer), you can use openssl s_client to see which cipher suite was negotiated by client and server. Splunk configuration allows you to require certain strength or disallow certain ciphers, see this section of docs for details:

0 Karma
Get Updates on the Splunk Community!

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...

Splunk Observability Cloud | Enhancing Your Onboarding Experience with the ...

We understand that your initial experience with getting data into Splunk Observability Cloud is crucial as it ...