TLS between splunk components

[Nawab]

We have below deployement, UF ----> HF ----> IDX

Uf are sending data to Hf and Hf is acting as and Intermediatry forwarder between UF and IDX.

Now we want to do TLS b/w splunk components. can we do TLS between HF and IDX and leave UFs.

Will UF data will also be TLS complient?

If not will UF still sends data to IDXs or we will stop receiving logs all together?

[Nawab]

Thanks for your answer, let me do it and check if it works.

Also why are you doing ssl on inputs.conf as per docs it should be done on outsputs of HF

[isoutamo]

Here is conf presentation about using TLS with splunk https://conf.splunk.com/files/2023/slides/SEC1936B.pdf

[VatsalJagani]

@Nawab- The answer is yes, you can setup SSL on both places and you can also set SSL only for HF to Indexer.

I think it should not matter what you use from UF to HF and HF to Indexer, they should act independent from each other.

Connection with SSL

inputs.conf
---------------
[splunktcp-ssl:9997]
serverCert = <string>
sslPassword = <string>
requireClientCert = <boolean>
sslVersions = <string>
cipherSuite = <cipher suite string>
ecdhCurves = <comma separated list of ec curves>
dhFile = <string>
allowSslRenegotiation = <boolean>
sslQuietShutdown = <boolean>
sslCommonNameToCheck = <commonName1>, <commonName2>, ...
sslAltNameToCheck = <alternateName1>, <alternateName2>, ...
useSSLCompression = <boolean>


outputs.conf
------------------
[tcpout]
defaultGroup = my_indexers

[tcpout:my_indexers]
server = <indexer>:9997
sslPassword = password
clientCert = $SPLUNK_HOME/etc/auth/server.pem
(<Check outputs.conf.spec for other SSL configs)

Connection without SSL

inputs.conf
---------------
[splunktcp:9997]


outputs.conf
------------------
[tcpout]
defaultGroup = my_indexers

[tcpout:my_indexers]
server = <indexer>:9997

I hope this helps!!!!