Installation

Enabling FIPS Mode (FIPS 140-2) on Splunk. How to determine which ciphers are used?

adnankhan5133
Communicator

We're planning to purchase Splunk (v8.0.6) and Splunk ES (v6.2) shortly, and have a requirement to enable FIPS Mode in order to meet government regulations. We'll be following the directions from this Splunk doc here: https://docs.splunk.com/Documentation/Splunk/8.0.6/Security/SecuringSplunkEnterprisewithFIPs 

Once we're running on FIPS 140-2, how do we determine which cipher is being used?

Labels (1)
Tags (1)
0 Karma

sowings
Splunk Employee
Splunk Employee

In general, you don't have to worry about the specific algorithm(s) being used for a TLS connection. By installing Splunk with FIPS mode enabled, you'll be installing FIPS-compliant cryptographic modules. This means that ciphers that are disallowed by FIPS won't be an option in the negotiation process that occurs between client and server during the TLS handshake. If you'd like to see which ciphers are available, you can use the openssl "ciphers" command (splunk cmd openssl ciphers) to see which are available on your system. Testing a connection to another node (say, a UF to an indexer), you can use openssl s_client to see which cipher suite was negotiated by client and server. Splunk configuration allows you to require certain strength or disallow certain ciphers, see this section of docs for details: https://docs.splunk.com/Documentation/Splunk/latest/Admin/Serverconf#SSL.2FTLS_Configuration_details

0 Karma
Get Updates on the Splunk Community!

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...

Use ‘em or lose ‘em | Splunk training units do expire

Whether it’s hummus, a ham sandwich, or a human, almost everything in this world has an expiration date. And, ...