Security
Highlighted

Splunk Enterprise 8089 Vulnerability Scan Results: How do I resolve these SSL errors?

Explorer

Hello,

I'm required to scan my Splunk Enterprise environment for compliance reasons. When I'm scanning my search heads and indexers ,I keep getting multiple SSL errors for the management port 8089. I've searched and haven't found a way figure out a method to upload a third party cert to fix this or if this is something that I'll just have to make not isn't fixable. I've included some of the vulnerability issues I've found. Not sure if opening a ticket with support would get me the information I need.

  1. SSL Version 2 and 3 Protocol Detected
  2. SSL Cert Signed Using Weak Hashing Algorithm (SHA1)
  3. SSL Certificate Wrong Hostname (Splunk Self Signed Cert running on 8089)
  4. TLS CRIME Vulnerability

Thanks!

0 Karma
Highlighted

Re: Splunk Enterprise 8089 Vulnerability Scan Results: How do I resolve these SSL errors?

Motivator

What version of Splunk?

If you 6.3+ you can have splunk use TLV1.2 cipherSuite OR upgrade Splunk to 6.4. Add that in your server.conf and everywhere else (inputs/outputs and web) Hope this helps!

Thanks,
Raghav

0 Karma
Highlighted

Re: Splunk Enterprise 8089 Vulnerability Scan Results: How do I resolve these SSL errors?

Explorer

using splunk 6.4.1, you got a link handy and i'll read through that?

Thanks!

0 Karma
Highlighted

Re: Splunk Enterprise 8089 Vulnerability Scan Results: How do I resolve these SSL errors?

Path Finder

i am using 6.4..4 and by scaning we got issue on 8008 port as SHA 1 alert
so how to make 8008 port (vmware DCN port) as secure?

0 Karma
Highlighted

Re: Splunk Enterprise 8089 Vulnerability Scan Results: How do I resolve these SSL errors?

Builder

You sure they can't allow exclusions? Generally all servers must be scanned to pass security compliance but even so exceptions are usually made provided justification for enterprise systems

0 Karma
Highlighted

Re: Splunk Enterprise 8089 Vulnerability Scan Results: How do I resolve these SSL errors?

Explorer

Generally, yes I should be able to exclude if I need to but... more than likely I'll need a reason why I'm leaving this enabled (yay compliance). Thanks for the suggestion though, that may be what has to happen.

0 Karma
Highlighted

Re: Splunk Enterprise 8089 Vulnerability Scan Results: How do I resolve these SSL errors?

Splunk Employee
Splunk Employee
  1. SSL Version 2 and 3 Protocol Detected
    => Disable SSLv2 and SSLv3, or specify tls1.2
    http://docs.splunk.com/Documentation/Splunk/6.4.2/Security/SetyourSSLversion

    1. SSL Cert Signed Using Weak Hashing Algorithm (SHA1) => Avoid using Splunk default certificate, and create your own certificate with stronger signiture (sha2 type) asking trusted CA. => openssl has option such as -sha256. For more detail, pleaes consult your trusted CA or google it regarding how to crate certificate with SHA256 or something like that! http://docs.splunk.com/Documentation/Splunk/6.4.2/Security/Howtogetthird-partycertificates
    2. SSL Certificate Wrong Hostname (Splunk Self Signed Cert running on 8089) => You need to craete your own certificate and use proper HostName. Splunk default cert does not use server's host name
    3. TLS CRIME Vulnerability https://answers.splunk.com/answers/65218/splunk-shows-vulnerable-to-cve-2012-4929-in-my-nessus-vulne...

View solution in original post

Highlighted

Re: Splunk Enterprise 8089 Vulnerability Scan Results: How do I resolve these SSL errors?

Explorer

Awesome!

That's what i was looking for!

Quick question, for 1,2,3 do those fixes apply for stuff on the management port (8089)?

Thanks

0 Karma
Highlighted

Re: Splunk Enterprise 8089 Vulnerability Scan Results: How do I resolve these SSL errors?

Splunk Employee
Splunk Employee

Yes, all of them can apply to the Splunk management port (default is 8089)

0 Karma
Highlighted

Re: Splunk Enterprise 8089 Vulnerability Scan Results: How do I resolve these SSL errors?

New Member

Thanks . This will be helpful

0 Karma