Security

Setting requireClientCert = true in server.conf prevents the CLI from communicating with splunkd

hexx
Splunk Employee
Splunk Employee

In server.conf.spec, it is indicated that requireClientCert = true can be set to require HTTPS clients connecting to splunkd to present a certificate signed by the CA whose public certificate we define in caCertFile in server.conf.spec :

requireClientCert = [true|false]

Requires that any HTTPS client that connects to splunkds internal HTTPS server has a certificate that was signed by our certificate authority.
Used by distributed search: Splunk indexing instances must be authenticated to connect to another splunk indexing instance.
Used by distributed deployment: The deployment server requires that deployment clients are authenticated before allowing them to poll for new configurations/applications.
If true, a client can connect ONLY if a certificate created by our certificate authority was used on that client.
Default is false

However, this appears to break communication between the CLI and splunkd :

[root@hostname local]# splunk login
Splunk username: admin
Password:
Couldn't get auth token: Couldn't complete HTTP request:
error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure

From web_service.log:

SplunkdConnectionException: Splunkd daemon is not responding: ('[Errno 1] _ssl.c:485: error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure',)
2011-04-14 14:19:22,335 ERROR [4da73aaa551ece7d0] startup:52 - Unable to read in product version information; Splunkd daemon is not responding: ('[Errno 1] _ssl.c:485: error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure',)
2011-04-14 14:19:22,336 ERROR [4da73aaa551ece7d0] decorators:361 - Splunkd daemon is not responding: ('[Errno 1] _ssl.c:485:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure',)

1 Solution

hexx
Splunk Employee
Splunk Employee

Because the CLI cannot be configured to present an SSL certificate, setting requireClientCert = true in server.conf does indeed break its ability to communicate with splunkd.

As of Splunk 4.3, this has been filed as bug SPL-47585.

View solution in original post

abhullar_splunk
Splunk Employee
Splunk Employee

There is a new bug filed as bug SPL-122988 for version 6.4.1 of Splunk

psow_splunk
Splunk Employee
Splunk Employee

Just an update that the issue on the communication being broken when authenticating the client cert has been fixed on Splunk 5.X

kenson
Explorer

The best workaround for this issue I've found is to proxy your request through socat like so:

socat TCP-LISTEN:1212,fork,reuseaddr  OPENSSL-CONNECT:somesplunk-instance:8089,verify=0,cert=somecert.pem

And then calling splunk like so:

./bin/splunk list monitor -uri http://localhost:1212

hexx
Splunk Employee
Splunk Employee

Nice work-around! Thank you for sharing it.

hexx
Splunk Employee
Splunk Employee

Because the CLI cannot be configured to present an SSL certificate, setting requireClientCert = true in server.conf does indeed break its ability to communicate with splunkd.

As of Splunk 4.3, this has been filed as bug SPL-47585.

Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...