Installation

Enabling FIPS Mode (FIPS 140-2) on Splunk. How to determine which ciphers are used?

adnankhan5133
Communicator

We're planning to purchase Splunk (v8.0.6) and Splunk ES (v6.2) shortly, and have a requirement to enable FIPS Mode in order to meet government regulations. We'll be following the directions from this Splunk doc here: https://docs.splunk.com/Documentation/Splunk/8.0.6/Security/SecuringSplunkEnterprisewithFIPs 

Once we're running on FIPS 140-2, how do we determine which cipher is being used?

Labels (1)
Tags (1)
0 Karma

sowings
Splunk Employee
Splunk Employee

In general, you don't have to worry about the specific algorithm(s) being used for a TLS connection. By installing Splunk with FIPS mode enabled, you'll be installing FIPS-compliant cryptographic modules. This means that ciphers that are disallowed by FIPS won't be an option in the negotiation process that occurs between client and server during the TLS handshake. If you'd like to see which ciphers are available, you can use the openssl "ciphers" command (splunk cmd openssl ciphers) to see which are available on your system. Testing a connection to another node (say, a UF to an indexer), you can use openssl s_client to see which cipher suite was negotiated by client and server. Splunk configuration allows you to require certain strength or disallow certain ciphers, see this section of docs for details: https://docs.splunk.com/Documentation/Splunk/latest/Admin/Serverconf#SSL.2FTLS_Configuration_details

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...