Getting Data In

Universal Forwarder authentication

bbegyperkspot
Explorer

Our use case is to have our Splunk indexer(s) running in one DC and our production hardware in another, in the public cloud at Rackspace, or in the public cloud at Amazon.

So restricting port 9997 to only a whitelist of IPs seems impractical. we can open the port to the internet at large, and SSL encrypt traffic (I think), but how to we authenticate that forwarders as legitimate senders?

If this is documented someplace I have been too dense to find, please let me know.

0 Karma
1 Solution

Ayn
Legend

There is no authentication mechanism within the session itself. You can, however, make use of SSL's authentication mechanisms in order to achieve this. Specifically by putting client certificates on your forwarders and telling the indexers to verify client certificates when an SSL connection is established, you would have authentication of your forwarders. More information is available here: http://docs.splunk.com/Documentation/Splunk/6.1.2/Security/ConfigureSplunkforwardingtousesignedcerti...

View solution in original post

0 Karma

Ayn
Legend

There is no authentication mechanism within the session itself. You can, however, make use of SSL's authentication mechanisms in order to achieve this. Specifically by putting client certificates on your forwarders and telling the indexers to verify client certificates when an SSL connection is established, you would have authentication of your forwarders. More information is available here: http://docs.splunk.com/Documentation/Splunk/6.1.2/Security/ConfigureSplunkforwardingtousesignedcerti...

0 Karma

JeremyHagan
Communicator

I've reviewed the doco for this and have to say that I am unimpressed. The private key is stored on the file system and the password for the key is in clear text in a config file. I'd hardly call this secure.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...