Getting Data In

Simple forwarder encryption

defaultdeny
Engager

Is it possible to configure a universal forwarder to encrypt WITHOUT requiring mutual auth? Like how most browsers work with HTTPS sites? Don't need to authenticate the client just prevent eavesdropping.

Tags (2)

starcher
SplunkTrust
SplunkTrust

dwaddle
SplunkTrust
SplunkTrust

Yes and no. Total agreement that useSSL=1 would be ideal. When a forwarder is set up to use SSL, providing a certificate to authenticate with is the only way to enable SSL. BUT, the indexer-side's inputs.conf decides whether a client certificate is actually needed to authenticate or not. I would like to see the forwarder side decouple "I would like to use SSL" from "Here is my client certificate"...

Also Brian rocks.

ebaileytu
Communicator

plus 1 - on useSSL=1 managing certs in a large forwarder environment is not much fun

0 Karma

defaultdeny
Engager

This does not answer my question. Question was answered via IRC by bosburn. The answer is that Splunk does not support this simple mode of encryption. I propose that this feature be added. Something like UseSSL = 1 instead of having to drop a client cert and configure a password on all end-points.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...