Splunk Enterprise 8089 Vulnerability Scan Results: How do I resolve these SSL errors?

[serwin]

Hello,

I'm required to scan my Splunk Enterprise environment for compliance reasons. When I'm scanning my search heads and indexers ,I keep getting multiple SSL errors for the management port 8089. I've searched and haven't found a way figure out a method to upload a third party cert to fix this or if this is something that I'll just have to make not isn't fixable. I've included some of the vulnerability issues I've found. Not sure if opening a ticket with support would get me the information I need.

1. SSL Version 2 and 3 Protocol Detected
2. SSL Cert Signed Using Weak Hashing Algorithm (SHA1)
3. SSL Certificate Wrong Hostname (Splunk Self Signed Cert running on 8089)
4. TLS CRIME Vulnerability

Thanks!

[Masa · Accepted solution]

1. SSL Version 2 and 3 Protocol Detected
   => Disable SSLv2 and SSLv3, or specify tls1.2
   http://docs.splunk.com/Documentation/Splunk/6.4.2/Security/SetyourSSLversion

   1. SSL Cert Signed Using Weak Hashing Algorithm (SHA1) => Avoid using Splunk default certificate, and create your own certificate with stronger signiture (sha2 type) asking trusted CA. => openssl has option such as -sha256. For more detail, pleaes consult your trusted CA or google it regarding how to crate certificate with SHA256 or something like that! http://docs.splunk.com/Documentation/Splunk/6.4.2/Security/Howtogetthird-partycertificates
   2. SSL Certificate Wrong Hostname (Splunk Self Signed Cert running on 8089) => You need to craete your own certificate and use proper HostName. Splunk default cert does not use server's host name
   3. TLS CRIME Vulnerability https://answers.splunk.com/answers/65218/splunk-shows-vulnerable-to-cve-2012-4929-in-my-nessus-vulne...

[usenetim]

Is there a version of the Universal forwarder that isn't prone to this issue?

[serwin]

Awesome!

That's what i was looking for!

Quick question, for 1,2,3 do those fixes apply for stuff on the management port (8089)?

Thanks

[syadavsplunk]

Thanks . This will be helpful

[Masa]

Yes, all of them can apply to the Splunk management port (default is 8089)

[Jarohnimo]

You sure they can't allow exclusions? Generally all servers must be scanned to pass security compliance but even so exceptions are usually made provided justification for enterprise systems

[serwin]

Generally, yes I should be able to exclude if I need to but... more than likely I'll need a reason why I'm leaving this enabled (yay compliance). Thanks for the suggestion though, that may be what has to happen.

[Raghav2384]

What version of Splunk?

If you 6.3+ you can have splunk use TLV1.2 cipherSuite OR upgrade Splunk to 6.4. Add that in your server.conf and everywhere else (inputs/outputs and web) Hope this helps!

Thanks,
Raghav

[splunk24]

i am using 6.4..4 and by scaning we got issue on 8008 port as SHA 1 alert
so how to make 8008 port (vmware DCN port) as secure?

[serwin]

using splunk 6.4.1, you got a link handy and i'll read through that?

Thanks!