Security
Highlighted

Setting requireClientCert = true in server.conf prevents the CLI from communicating with splunkd

Influencer

In server.conf.spec, it is indicated that requireClientCert = true can be set to require HTTPS clients connecting to splunkd to present a certificate signed by the CA whose public certificate we define in caCertFile in server.conf.spec :

requireClientCert = [true|false]

Requires that any HTTPS client that connects to splunkds internal HTTPS server has a certificate that was signed by our certificate authority.
Used by distributed search: Splunk indexing instances must be authenticated to connect to another splunk indexing instance.
Used by distributed deployment: The deployment server requires that deployment clients are authenticated before allowing them to poll for new configurations/applications.
If true, a client can connect ONLY if a certificate created by our certificate authority was used on that client.
Default is false

However, this appears to break communication between the CLI and splunkd :

[root@hostname local]# splunk login
Splunk username: admin
Password:
Couldn't get auth token: Couldn't complete HTTP request:
error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure

From web_service.log:

SplunkdConnectionException: Splunkd daemon is not responding: ('[Errno 1] ssl.c:485: error:14094410:SSL routines:SSL3READBYTES:sslv3 alert handshake failure',)
2011-04-14 14:19:22,335 ERROR [4da73aaa551ece7d0] startup:52 - Unable to read in product version information; Splunkd daemon is not responding: ('[Errno 1] _ssl.c:485: error:14094410:SSL routines:SSL3
READBYTES:sslv3 alert handshake failure',)
2011-04-14 14:19:22,336 ERROR [4da73aaa551ece7d0] decorators:361 - Splunkd daemon is not responding: ('[Errno 1] _ssl.c:485:error:14094410:SSL routines:SSL3
READ_BYTES:sslv3 alert handshake failure',)

Highlighted

Re: Setting requireClientCert = true in server.conf prevents the CLI from communicating with splunkd

Influencer

Because the CLI cannot be configured to present an SSL certificate, setting requireClientCert = true in server.conf does indeed break its ability to communicate with splunkd.

As of Splunk 4.3, this has been filed as bug SPL-47585.

View solution in original post

Highlighted

Re: Setting requireClientCert = true in server.conf prevents the CLI from communicating with splunkd

Explorer

The best workaround for this issue I've found is to proxy your request through socat like so:

socat TCP-LISTEN:1212,fork,reuseaddr  OPENSSL-CONNECT:somesplunk-instance:8089,verify=0,cert=somecert.pem

And then calling splunk like so:

./bin/splunk list monitor -uri http://localhost:1212
Highlighted

Re: Setting requireClientCert = true in server.conf prevents the CLI from communicating with splunkd

Influencer

Nice work-around! Thank you for sharing it.

Highlighted

Re: Setting requireClientCert = true in server.conf prevents the CLI from communicating with splunkd

Explorer

Just an update that the issue on the communication being broken when authenticating the client cert has been fixed on Splunk 5.X

Highlighted

Re: Setting requireClientCert = true in server.conf prevents the CLI from communicating with splunkd

There is a new bug filed as bug SPL-122988 for version 6.4.1 of Splunk