Any handy way to know what cipher Splunk server supports?

[daniel_splunk]

I want to tighten the security by only allowing certain ciphers to be configured. Any handy tool to check what cipher Splunk currently supports?

[mstjohn_splunk]

Hi @daniel_splunk - Were you able to test out @inventsekar 's solution? Or, did your answer below solve the problem? If yes to either of those options, please don't forget to resolve this post by clicking on "Accept". If you still need more help, please provide a comment with some feedback. Thanks!

[inventsekar]

https://docs.splunk.com/Documentation/Splunk/7.1.2/Security/Ciphersuites

inputs.conf

   sslVersions = tls1.2
    cipherSuite = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-
    SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-
    AES128-SHA256:ECDHE-RSA-AES128-SHA256
    ecdhCurves = prime256v1, secp384r1, secp521r1

[daniel_splunk]

Here is some script that you can use to test the Splunk port by using openssl.

#!/usr/bin/env bash

# OpenSSL requires the server IP and port number
SERVER=127.0.0.1:8089
DELAY=1
ciphers=$(openssl ciphers 'ALL:eNULL' | sed -e 's/:/ /g')

echo Obtaining cipher list from $(openssl version).

for cipher in ${ciphers[@]}
do
echo -n Testing $cipher...
result=$(echo -n | openssl s_client -cipher "$cipher" -connect $SERVER 2>&1)
if [[ "$result" =~ ":error:" ]] ; then
  error=$(echo -n $result | cut -d':' -f6)
  echo NO \($error\)
else
  if [[ "$result" =~ "Cipher is ${cipher}" || "$result" =~ "Cipher    :" ]] ; then
    echo YES
  else
    echo UNKNOWN RESPONSE
    echo $result
  fi
fi
sleep $DELAY
done 

A sample run again Splunk 7.1.2 with port 8089 will below result.

# ./openssl.sh | grep YES
Testing ECDHE-RSA-AES256-GCM-SHA384...YES
Testing ECDHE-RSA-AES256-SHA384...YES
Testing AES256-GCM-SHA384...YES
Testing ECDHE-RSA-AES128-GCM-SHA256...YES
Testing ECDHE-RSA-AES128-SHA256...YES
Testing AES128-GCM-SHA256...YES
Testing AES128-SHA256...YES