Splunk integration with Duo connector

[ririzk]

Growing a bit exasperated with the issue that Im facing while integrating Splunk with Duo admin api, seeing the following error right form the get go during the initial configuration. EOF occured in violation of protocol (_ssl. c:1106). I have not seen it before and its even stranger as there is no connectivity issues, a curl to my api host shows connectivity is fine, no problem there. TLS handshake is successful. TCP dump shows that it was able to reach out to Duo cloud's IP, 

here's a screenshot of the error preventing me from proceeding

The error is happening at intial setup, its so hard to determine why with no information or logs to go off... is anyone familiar with this?

[tscroggins]

Hi @ririzk, 

Coordinating support between two vendors is challenging, but if using Duo's recommended Splunk configuration or browsing https://help.duo.com/s/global-search/Splunk%20Connector doesn't help solve your problem, you may need to contact Duo support directly.

[ririzk]

hey @tscroggins thanks for replying. Is there anything that you know about this particular error? That error code:(_ssl. c:1106)

is there a splunk guide for these errors?

[tscroggins]

I just set up a free Duo account and installed and configured the add-on without issues. The only other things I can suggest are 1) verify your Splunk instance's public egress address is in the Admin API application's "Networks for API access" list, 2) verify any intervening host or network firewalls or transparent proxies allow connectivity to your API hostname, and 3) verify your Splunk host can connect to your API hostname using openssl:

$SPLUNK_HOME/bin/splunk cmd openssl s_client -connect api-xxx.duosecurity.com:443

The Duo Admin API Python client used by the add-on supports HTTP proxies, but Duo didn't include proxy support in the modular input. If you need this feature, you'll need to request it from Duo.

[tscroggins]

Hi @ririzk,

_ssl.c is part of Python, not Splunk. A quick look at a non-specific version of the _ssl.c source code shows that error is returned when a connection is closed unexpectedly. You should contact Duo support for more detail.