Security

How to allow TLSv1.1 with AES256-SHA in HEC with Splunk 8?

yuanliu
SplunkTrust
SplunkTrust

Splunk 8's HEC defaults to TLSv1.2 only.  But I have a need to allow TLSv1.1 with AES256-SHA in order for puppetserver 2.7.0 to connect.

So far, I figured that in order to effect HEC protocols, I must also alter $SPLUNKE_HOME/etc/system/local/web.conf.  So I changed sslVersion to *, and made sure that AES256-SHA is in cipherSuite.  I can verify that TLSv1.1 is allowed when using openssl command line to connect; the same code in Puppet's splunk_hec reporter is also able to connect via TLSv1.1 when invoked from native Ruby (Ruby 2.0).  But I cannot externally examine the exact cipher used even with Wireshark.

Anyway, even with this setup on Splunk's side, I still get "ssl3_get_client_hello:no shared cipher" when puppetserver tries to connect.  The difference is that puppetserver 2.7.0 runs in outdated JRuby that uses Ruby 1.9.  Nevertheless, https://ask.puppet.com/question/33316/puppet-https-connection-using-latest-tls-version-and-cipher-su... states "the only way to get puppet to successfully connect is to enable the AES256-SHA cipher."  So, I would expect the combination to be successful.

What other things do I need to change?

Labels (2)
Tags (3)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

Contrary to results from my numerous previous experiments, the final configuration is rather simple (and less compromising than I initially feared): Add AES256-SHA to cipherSuite in $SPLUNK_HOME/etc/apps/splunk_httpinput/local/inputs.conf.

(In other words, web.conf doesn't affect HEC, after all.  The real problem with puppetserver 2.7.0 is SERVER-2036 which was fixed in Server 5.5.  I'll describe a workaround in the other post about splunk_hec.)

View solution in original post

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Contrary to results from my numerous previous experiments, the final configuration is rather simple (and less compromising than I initially feared): Add AES256-SHA to cipherSuite in $SPLUNK_HOME/etc/apps/splunk_httpinput/local/inputs.conf.

(In other words, web.conf doesn't affect HEC, after all.  The real problem with puppetserver 2.7.0 is SERVER-2036 which was fixed in Server 5.5.  I'll describe a workaround in the other post about splunk_hec.)

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...