Security

Does Splunk LDAP support STARTTLS?

mpavlas
Explorer

According to Tenable we will have to disable LDAPS soon.
Is it possible to use STARTTLS on LDAP port in Splunk instead?

0 Karma
1 Solution

sylim_splunk
Splunk Employee
Splunk Employee

As of this writing the latest Splunk does not support STARTTLS.

View solution in original post

rfaircloth_splu
Splunk Employee
Splunk Employee

the original answer "no start TLS" is the correct answer. My response was to provide additional color to the reason for the question which is a vuln scanner is driving an incorrect response to "disable" ldaps. When the proper fix is simply to harden ldaps.

0 Karma

rfaircloth_splu
Splunk Employee
Splunk Employee

LDAPS as with most things (s) such as https the s stands for secure not SSL. The LDAP server configuration determines what crypto is offered and should be updated to only permit appropriately secure TLS options. "STARTTLS" is a potentially less secure choice where the server defaults to insecure communication and requires the client to request a step up to secure. This was a useful bridge for legacy communications such as LDAP, SMTP, and FTP but is not related to the need to remove support for older now less secure encryption protocols SSL* TLS 1.0 and TLS 1.1

Presuming your LDAP server is Microsoft Active Directory this vulnerability should be reviewed by your Active Directory admins to resolve.

This may also be a great time to consider moving to SAML based authentication to reduce the risk of credential compromise via plain text bind.

0 Karma

jpl3harris
Engager

This is not an answer. This is weasely language to put off the fact that we don't have a clear answer. Does Splunk support STARTTLS or not? It is a Yes or No answer.

"STARTTLS" is a potentially less secure choice where the server defaults to insecure communication
This is avoiding the technical question and a non-answer.

This was a useful bridge for legacy communications such as LDAP, SMTP, and FTP but is not related to the need to remove support for older now less secure encryption protocols SSL* TLS 1.0 and TLS 1.1
The question is not about the default security considerations of the users LDAP server.

0 Karma

sylim_splunk
Splunk Employee
Splunk Employee

As of this writing the latest Splunk does not support STARTTLS.

View solution in original post

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.