What is the process to create SSL NON self signed certificates on the splunk forwarders? Currently when a splunk forwarder is installed on a Windows OS it will create a self signed certificate. However we do wish that a certificate from our own Microsoft CA is used. The best way (if possible) would be if the splunk forwarder or the splunk deployment server could connect to our Microsoft CA and request these certificates. Or must we replace all these certificates constantly on all our windows hosts (we do have more then a handfull!!). ... View more

Hello, our Nessus scanner show a issue with the 56 bit SSL ciphers which are allowed by the splunk forwarder: Synopsis: The remote service supports the use of medium strength SSL ciphers.

Description
The remote host supports the use of SSL ciphers that offer medium strength encryption, which we currently regard as those with key lengths at least 56 bits and less than 112 bits.

Note: This is considerably easier to exploit if the attacker is on the same physical network.

Solution
Reconfigure the affected application if possible to avoid use of medium strength ciphers.

Risk Factor: Medium

CVSS Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N)

Plugin Output
Here is the list of medium strength SSL ciphers supported by the remote server :

 Medium Strength Ciphers (>= 56-bit and < 112-bit key)

 SSLv3
 ADH-DES-CBC-SHA Kx=DH Au=None Enc=DES(56) Mac=SHA1 

 TLSv1
 ADH-DES-CBC-SHA Kx=DH Au=None Enc=DES(56) Mac=SHA1 

The fields above are :

 {OpenSSL ciphername}
 Kx={key exchange}
 Au={authentication}
 Enc={symmetric encryption method}
 Mac={message authentication code}
 {export flag}

Plugin Publication Date: 2009/11/23

Plugin Last Modification Date: 2012/04/02
 It looks like we can change the inputs.conf: [SSL] # default cipher suites that splunk allows. Change this if you wish to increase the security # of SSL connections, or to lower it if you having trouble connecting to splunk. cipherSuite = ALL:!aNULL:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM with some values from OpenSSL as mentioned here: http://www.openssl.org/docs/apps/ciphers.html but I´m unsure about the vaules Splunk would allow here. ... View more

Hello, since October 2012 our Nessus environment list a "TLS Crime Vulnerability" on all our Windows Server who have the (currently 5.0.1) Splunk Forwarder installed. Can that be solved via config (e.g. disable disable compression and / or the SPDY service)? If yes how? Synopsis: The remote service has a configuration that may make it vulnerable to the CRIME attack.

Description
The remote service has one of two configurations that are known to be required for the CRIME attack: 

 - SSL / TLS compression is enabled.

 - TLS advertises the SPDY protocol earlier than version 4.

 Note that Nessus did not attempt to launch the CRIME attack against the remote service.

Solution
Disable compression and / or the SPDY service.

 See Also 
http://www.iacr.org/cryptodb/data/paper.php?pubkey=3091
 http://www.nessus.org/u?a1e45597

 Risk Factor: Medium

 CVSS Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N)

CVSS Temporal Score
3.6 (CVSS2#E:F/RL:OF/RC:C)

 Plugin Output
 The following configuration indicates that the remote service
may be vulnerable to the CRIME attack :

 - SSL / TLS compression is enabled.

 CVE
CVE-2012-4929
CVE-2012-4930

BID
55704
55707

Cross-References 
OSVDB:85926
OSVDB:85927

 Vulnerability Publication Date: 2012/09/15

 Plugin Publication Date: 2012/10/16

 Plugin Last Modification Date: 2012/10/22 

Public Exploit Available: True

 ... View more

Hello, how can I set the "supportSSLV3Only = true" (= false is the default) via CLI in the server.conf? This must be done one a lot of servers and it is very time consuming to do that on every one by hand. ... View more

Our Nessus scan is currently mention the following issues for a service running on port 8089 (which is the splunk forwarder). The complete issue is: *Synopsis: The remote service allows repeated renegotiation of TLS / SSL connections.

 Description
: The remote service encrypts traffic using TLS / SSL and permits clients to renegotiate connections. The computational requirements for renegotiating a connection are asymmetrical between the client and the server, with the server performing several times more work. Since the remote host does not appear to limit the number of renegotiations for a single TLS / SSL connection, this permits a client to open several simultaneous connections and repeatedly renegotiate them, possibly leading to a denial of service condition.

 Solution
: Contact the vendor for specific patch information.* How can we solve that? ... View more