Splunk Enterprise

Does Spunk use TLS/SSL in communication between components?

Haleb
Path Finder

Could you please confirm whether Splunk utilizes TLS/SSL for the following communications by default or it should be manually configured:

  1. Between Search Heads and Indexers
  2. Between Indexers (Index Clustering)
Labels (2)
Tags (3)
0 Karma
1 Solution

deepakc
Builder

By Default when you install Splunk it installs default certs that can be used, but these should be changed as per your organisations TLS cert process alongside the TLS requirements as per the Splunk docs. The default ones are only used for testing, POC etc. 

If you look at the table from this document link, it shows the various components and TLS cert scenarios for Splunk enterprise and cloud and default status.

https://docs.splunk.com/Documentation/Splunk/9.2.1/Security/AboutsecuringyourSplunkconfigurationwith... 

So, in your case.

  1. (Between Search Heads and Indexers) You would need to create TLS cert for Web Browser Access, not use the default ones, unless just testing - this will give you config and search data. Note the SH should be connected to the Indexers via the Cluster Manager.
  2. Between Indexers (Index Clustering) - If you configure indexers in a cluster, they should also use TLS certificate - this will be for replication data, again its best to create your TLS certs for all the indexers.

Side note: You typically also use the UF's with the indexers certs for UF to Indexer TLS data encryption.

Here's a good link for Splunk TLS certs process and understanding

https://lantern.splunk.com/Splunk_Platform/Product_Tips/Administration/Securing_the_Splunk_platform_... 

View solution in original post

deepakc
Builder

By Default when you install Splunk it installs default certs that can be used, but these should be changed as per your organisations TLS cert process alongside the TLS requirements as per the Splunk docs. The default ones are only used for testing, POC etc. 

If you look at the table from this document link, it shows the various components and TLS cert scenarios for Splunk enterprise and cloud and default status.

https://docs.splunk.com/Documentation/Splunk/9.2.1/Security/AboutsecuringyourSplunkconfigurationwith... 

So, in your case.

  1. (Between Search Heads and Indexers) You would need to create TLS cert for Web Browser Access, not use the default ones, unless just testing - this will give you config and search data. Note the SH should be connected to the Indexers via the Cluster Manager.
  2. Between Indexers (Index Clustering) - If you configure indexers in a cluster, they should also use TLS certificate - this will be for replication data, again its best to create your TLS certs for all the indexers.

Side note: You typically also use the UF's with the indexers certs for UF to Indexer TLS data encryption.

Here's a good link for Splunk TLS certs process and understanding

https://lantern.splunk.com/Splunk_Platform/Product_Tips/Administration/Securing_the_Splunk_platform_... 

Get Updates on the Splunk Community!

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...

Splunk and Fraud

Watch Now!Watch an insightful webinar where we delve into the innovative approaches to solving fraud using the ...