Does Splunk LDAP support STARTTLS?

[mpavlas]

According to Tenable we will have to disable LDAPS soon.
Is it possible to use STARTTLS on LDAP port in Splunk instead?

[rfaircloth_splu]

the original answer "no start TLS" is the correct answer. My response was to provide additional color to the reason for the question which is a vuln scanner is driving an incorrect response to "disable" ldaps. When the proper fix is simply to harden ldaps.

[rfaircloth_splu]

LDAPS as with most things (s) such as https the s stands for secure not SSL. The LDAP server configuration determines what crypto is offered and should be updated to only permit appropriately secure TLS options. "STARTTLS" is a potentially less secure choice where the server defaults to insecure communication and requires the client to request a step up to secure. This was a useful bridge for legacy communications such as LDAP, SMTP, and FTP but is not related to the need to remove support for older now less secure encryption protocols SSL* TLS 1.0 and TLS 1.1

Presuming your LDAP server is Microsoft Active Directory this vulnerability should be reviewed by your Active Directory admins to resolve.

This may also be a great time to consider moving to SAML based authentication to reduce the risk of credential compromise via plain text bind.

[jpl3harris]

This is not an answer. This is weasely language to put off the fact that we don't have a clear answer. Does Splunk support STARTTLS or not? It is a Yes or No answer.

"STARTTLS" is a potentially less secure choice where the server defaults to insecure communication
This is avoiding the technical question and a non-answer.

This was a useful bridge for legacy communications such as LDAP, SMTP, and FTP but is not related to the need to remove support for older now less secure encryption protocols SSL* TLS 1.0 and TLS 1.1
The question is not about the default security considerations of the users LDAP server.

[sylim_splunk · Accepted solution]

As of this writing the latest Splunk does not support STARTTLS.