Security

Additional SSL Verification

v_trilo
New Member

Hey everyone.
First time SSL setup (IDX & UF both v8.x) and cert creation (never done before). Had a question about verifying if things worked. I walked through splunk docs and got to the point of verifying connection.

https://docs.splunk.com/Documentation/Splunk/8.0.2/Security/Validateyourconfiguration

On my IDX i can run:

index=_internal source=*metrics.log* group=tcpin_connections | 
dedup hostname | table _time hostname version sourceIp destPort ssl

I do get expected result returned port (9998) and SSL = true.
BUT this was the only part of the instructions that i could follow to verify SSL items. I can't find anything else within Splunkd or index=_* referencing what is being mentioned in the validating procedures for the UF portion. I can see that the UF has the following output in splunkd "Connected to idx=10.202.20.229:9998". This UF is only setup to forward to the one server over port 9998.

The next steps i followed where on this page https://docs.splunk.com/Documentation/Splunk/8.0.2/Security/Troubleshootyouforwardertoindexerauthent...

openssl s_client -connect <server>:<port>

and the expected output mentioned Verify return code: 0 (ok) was instead returning code: 18 (self signed certificate).
Then on the UF i attempted to monitor a random log file that i update. On the main Splunk server i can see the data come in.
I'm just second guessing if i did things correctly given i wasn't able to validate internal Splunk logs.

UF

server.conf 
 [sslConfig]
 sslRootCAPath = /opt/splunkforwarder/etc/auth/myCerts/myCACertificate.pem
 sslPassword = <with pass here>
outputs.conf 
 [SSL]
 [tcpout]
defaultGroup = group1
 [tcpout:group1]
 server = 10.202.20.229:9998
 disabled = 0
 clientCert = /opt/splunkforwarder/etc/auth/myCerts/myNewSplunkForwarderCert.pem
useClientSSLCompression = true
sslPassword = <with pass here>

IDX

inputs.conf
 [splunktcp-ssl:9998]
disabled = 0
[SSL]
serverCert = /opt/splunk/etc/auth/myCerts/myNewSplunkIndexerCert.pem
sslPassword = <with pass here>
requireClientCert = "true"
server.conf
 [sslConfig]
 sslRootCAPath = /opt/splunk/etc/auth/myCerts/myCACertificate.pem
 sslPassword = <with pass here>
Labels (2)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...