About MrMcGeough

MrMcGeough · ‎06-27-2018

I followed that guide to force TLS. As I said above, "I'm not entirely clear how I can be certain that I am using TLS 1.2 exclusively across all Splunk servers." When they shut down SSL3, I don't want to find out that somehow Splunk was still using it for 'x' to communicate.

MrMcGeough · ‎06-26-2018

I need to disable SSL3 and enable TLS 1.2 across all of Splunk Enterprise. SSL3 is being disabled entirely in my organization. If I just add "sslVersions = -tls1.1, tls1.2, -sslv2, -sslv3" to the inputs.conf, server.conf (under [sslConfig] ) and web.conf on the Indexer, would this not force all forwarders to use TLS 1.2 (or not connect at all if TLS 1.2 is not enabled on the forwarder)? I have read a number of questions on this, and I'm not entirely clear how I can be certain that I am using TLS 1.2 exclusively across all Splunk servers.

MrMcGeough · ‎05-03-2018

Fixed! After backing up /opt/splunkforwarder/etc/auth/mycerts and /opt/splunkforwarder/etc/system/local I went ahead and got the Ops group to delete /opt/splunkforwarder/etc (and all subs). Uploaded a new copy of the install tar for 7.0.3 and had them do a gunzip to install. On startup the server.pem file was missing for some reason so I grabbed a working copy from another 7.0.3 host and it worked. The indexer is now reporting 7.0.3 for this forwarder properly!

MrMcGeough · ‎04-17-2018

Thanks for your comment ckurtz. I have 6 AIX forwarders and all were updated at the same time. Only one of them is mis-reporting the version. If I had access to do the install myself I would, but they have the servers so locked down here I have to open a change ticket which takes about 1/2 hour, wait for assessment by many people, and then wait a week to have the steps performed.

MrMcGeough · ‎04-13-2018

Sounds more realistic than negative to me.

MrMcGeough · ‎04-13-2018

Have tried that, but I just ran it again. No change.

MrMcGeough · ‎04-13-2018

Thanks for your reply. Same result I'm afraid. The Monitoring Console also reports version 7.0.2 for this host. I think that's how it's coming to the indexer. I just don't know why.

MrMcGeough · ‎04-12-2018

I recently upgraded all of my Universal Forwarders (UF) to 7.0.3 from various version levels (some 6.3.3, some were 7.x). On one of the forwarders (AIX) when I run the command; ./splunk version I get; "Splunk Universal Forwarder 7.0.3" But a search to list forwarder versions on the indexer lists a different version for the same host; index=_internal sourcetype=splunkd group=tcpin_connections | stats first(version) by hostname I get; "Version 7.0.2" Why are the versions being listed differently? After the upgrade, this is the only UF not listing 7.0.3 at the indexer.

Posts	8
Solutions	0
Karma Given	2
Karma Received	1
Member Since	‎04-12-2018

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Can I force forwarders to use TLS 1.2 by disabling...

Why is the UF version on forwarder different than ...

Re: Can I force forwarders to use TLS 1.2 by disab...

Can I force forwarders to use TLS 1.2 by disabling...

Re: Why is the UF version on forwarder different t...

Re: Why is the UF version on forwarder different t...

Re: Why is the UF version on forwarder different t...

Re: Why is the UF version on forwarder different t...

Re: Why is the UF version on forwarder different t...

Why is the UF version on forwarder different than ...