Deployment Architecture

client connecting issue when only TLS is enabled

arber
Communicator

Hi,

we have an environmet and due to the POODLE vulnerability that was present on port 8089 on the server we have to force the TLS by adding this on server.conf file

sslVersions = tls1.0, tls1.1, tls1.2

the problem is that after the restart of the splunkd none of the servers that were previously connecting on the forwarder management section is showing up, The data are still coming it is just the servers that are not connected anymore.

Any suggestions, it seems like the clients use only sslv3 to connect

Thanks

Tags (3)
0 Karma

cam343
Path Finder

Hi Arber,
I suspect your seeing is the same problem I'm experiencing at a clients site.
Firstly the client, in the great poodle rush, disabled SSLv3 via server.conf on the indexer.
Unfortunately the syntax they used was incorrect. What they should have used is (as per server.conf documentation):

sslVersions = tls1.2

The problem I am seeing is that when implementing the above directive or even: "sslVersions = tls" Windows clients can not connect to the deployment server, but forwarding data still works...

When running Splunk 6.13 (or anything less than 6.2 actually) the errors logged on the indexer are:
a). Shared Ciphers
b). SSL Version numbers.

So I suspect that while the inbuilt openssl on Splunk 6.13 supports TLS protocol and associated ciphersuites, something else is causing it to fail.
Therefore I suspect upgrading to Splunk 6.2 or greater will resolve the issue.

I'll report back after the upgrade.

0 Karma

DimasSouza
Path Finder

Hi there,

did you follow the intructions from Splunkdocs? You have to update your forwarder configuration as well.

http://docs.splunk.com/Documentation/Splunk/latest/Security/ConfigureSplunkforwardingtousethedefault...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...