Security

Why does splunkweb hang when I try to access it with Internet Explorer 8 over SSL?

yodaut
Explorer

I can access my Splunk web and login, run searches, etc. with Chrome, Firefox, Safari... pretty much any browser that isn't IE8.

When I try to access the Splunk login URL with IE8 loads about half the page content, then hangs.

Subsequent access to Splunk web login URL with other non-IE browsers fail as well.

If I restart splunk web, other non-IE browsers work again. If I then try to access splunkweb with IE8 again, it hangs again and I'm back to where I started.

Has anyone seen this? Any suggestions (other than "don't use IE") ?

Splunk 4.1.1 build 78281 on server running Splunk Web interface (and primary indexer).

Internet Explorer 8 + Windows 7 64-bit.

Confirmed from multiple machines.

Tags (2)

chicodeme
Communicator

I have experienced the same problem and I am required to leave sslv2 off.. so supportSSLV3Only = True must stay on.. For FF, IE6/7/8, Chrome they all experienced problems. Opera did not because it does not support sslv2 anymore.. If you turn off sslv2 support in ie6/7/8 this problem goes away. In doing that Chrome will start working because it uses IE's settings. Firefox about:config and turn off sslv2.. All my browsers I didn't have to turn it off it was already off.. but I had cohorts that I had to have turn it off in order to access splunkweb. you can duplicate the problem with openssl

[root@csc06splunkdev01 default]# openssl s_client -ssl3 -connect servername:8000 * works just fine, but have to specify to use ssl3 *

[root@csc06splunkdev01 default]# openssl s_client -connect servername:8000 CONNECTED(00000003) write:errno=104 ** fails cuz it defaults to sslv2 **

splunk-4.1.4-82143

0 Karma

jeff
Contributor

Voted the "solution" up but will be filing a defect report with support if it hasn't been done already.

0 Karma

jrodman
Splunk Employee
Splunk Employee

Yodaut says:

i may have solved my own problem... i had:

# Allow only SSLv3 connections if true 
# NOTE: Enabling this may cause some browsers problems
#supportSSLV3Only = True 

set to true my web.conf... maybe IE8 and splunkweb really really don't like that. i've commented out the line and restarted services. things appear to be a bit happier now.

Note some ssl problems have been solved between 4.1.2. and 4.1.4, so it's possible the workaround may no longer be necessary to avoid wedging splunkweb, but probably is still recommended for compatibility with that combination of software.

jrodman
Splunk Employee
Splunk Employee

Hmm, answers isn't letting me comment on the question, so here's a non-answer.

The fact that you can't access with non-IE browsers makes this sound like a server-side problem.

Have you tested accessability from other workstations?

Have you reconfigured splunkweb in any way (eg enabling SSL, any changes really to web.conf).

Are there any juicy errors in var/log/splunk/web_service.log?

0 Karma

Justin_Grant
Contributor

@yodaut - if you've found the solution to the problem, could you post it a an answer (not a comment) and accept it? this will enable other folks who run across the same problem to find your answer more easily. thanks!

0 Karma

yodaut
Explorer

i may have solved my own problem... i had: # Allow only SSLv3 connections if true

NOTE: Enabling this may cause some browsers problems

supportSSLV3Only = True

set to true my web.conf... maybe IE8 and splunkweb really really don't like that. i've commented out the line and restarted services. things appear to be a bit happier now. i'll let you know if/when it wedges again under ie.

0 Karma

yodaut
Explorer

The output of web_service.log after a splunkweb restart and subsequent browsing with IE8 (briefly) until it hangs is too long to paste here... is there a way to attach files or something?

0 Karma

yodaut
Explorer

Non-IE browser DO work... up until the point when I try to access splunkweb with IE8. Then no browsers can access it until splunk web is restarted.

Multiple workstations confirm the IE8 hang.

The only reconfiguration of web.conf I've done is to configure splunkweb to use SSL via a certificate issued from our internal Microsoft CA and to use port 443. I can post the file if required.

Upon testing, I'm actually getting further today than previously. I can actually bring up the log in page and log in, but if I close the browser window and try it again, it's hung for all browsers.

0 Karma

Johnvey
Contributor

IE8 is fully supported, so this is unexpected behavior. 1) Clear your browser cache (IE calls it 'delete temporary internet files'). 2) What is your internet security setting when accessing Splunk?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...