Getting Data In

Splunk DB Connect: Why can't I get java bridge to run after configuring splunkd to use SSL with syntax copied from the release notes?

sjh65
Explorer

After configuring splunkd to use SSL, with

/etc/system/local/server.conf

[sslConfig]
enableSplunkdSSL = true
sslVersions = <*, -sslv2 , -sslv3>

I wasn't able to get the java bridge to run with the syntax copied from the release notes or even just TLSv1 in the <> I instead had to use sslVersion*s* and the same syntax that i used in the server.conf file to get the jbridge to start up again.

/etc/apps/dbx/local/java.conf

[splunkd]
sslVersions = <*, -sslv2 , -sslv3>
#sslVersion = <SSLv3, TLSv1>

The release notes for 1.1.16

The Java Bridge Server can now use either SSL or TLS for security encryption when connecting to splunkd. Both are enabled by default. To specify one or the other, edit the following lines in dbx/local/java.conf:

[splunkd]
sslVersion = < SSLv3, TLSv1 >

This fixes the problem that arose when a user set the encryption scheme to TLS in /etc/system/local/server.conf to avoid the SSL >POODLE vulnerability. (DBX-1025)

with a snippet from the jbridge.log when using plain

Exception in thread "main" java.lang.IllegalArgumentException: <TLSv1>    at sun.security.ssl.ProtocolVersion.valueOf(ProtocolVersion.java:164)   at sun.security.ssl.ProtocolList.convert(ProtocolList.java:84)      at sun.security.ssl.ProtocolList.<init>(ProtocolList.java:52)       at sun.security.ssl.SSLSocketImpl.setEnabledProtocols(SSLSocketImpl.java:2394)      at com.splunk.rest.Splunkd$SSLSocketFactoryImpl.configure(Splunkd.java:288)         at com.splunk.rest.Splunkd$SSLSocketFactoryImpl.createSocket(Splunkd.java:313)      at sun.net.www.protocol.https.HttpsClient.createSocket(HttpsClient.java:409)        at sun.net.NetworkClient.doConnect(NetworkClient.java:162)      at sun.net.www.http.HttpClient.openServer(HttpClient.java:432)

So I guess the question is, do the release notes have the syntax wrong?

0 Karma
1 Solution

mtevenan_splunk
Splunk Employee
Splunk Employee

Hi there. I'm the writer for this documentation. Apologies for the confusion. The "< >" syntax is supposed to indicate that you should choose one of the values between the "< >" symbols, but I realize that many folks are going to be copying and pasting. I've updated the page to make it more clear what syntax you should use.

Thanks for the feedback!
Matt Tevenan

View solution in original post

mtevenan_splunk
Splunk Employee
Splunk Employee

Hi there. I'm the writer for this documentation. Apologies for the confusion. The "< >" syntax is supposed to indicate that you should choose one of the values between the "< >" symbols, but I realize that many folks are going to be copying and pasting. I've updated the page to make it more clear what syntax you should use.

Thanks for the feedback!
Matt Tevenan

hansdi
New Member

I had a similar issue recently. After some trial and error, the stanza that worked for me (bear in mind I wanted to use a specific version of TLS) was:

[splunkd]
sslVersion = TLSv1.2

I agree it is not ideal for the parameter to be called sslVersions in some conf files and sslVersion in the app conf file.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...