Security

myServerCertificate.pem

ephemeric
Contributor

Greetz,

http://wiki.splunk.com/Community:Splunk2Splunk_SSL_3rdPartyCA

I have followed the above article and have noticed that one copies the private server key to all the forwarders in said example (myServerCertificate.pem). If one of the forwarders is compromised then one can impersonate the same Splunk server with said server certificate.

This surely must be wrong?

0 Karma

kristian_kolb
Ultra Champion

Perhaps things have changed a little bit since the article was written, but we deploy (to forwarders) a forwarder.pem (containing a forwarder certificate and its key in one file), and the cacert.pem, which is the CA certificate ONLY (not the key), which is used to verify the indexers.

The indexer has a similar setup; indexer.pem (cert + key) cacert.pem (cert)

This works well, and for log forwarding this can be deployed in an app. Setting up certificates for handling the deployment traffic cannot (obviously) be done through a deployed app.

Hope this helps,

Kristian

0 Karma

kristian_kolb
Ultra Champion

Aah. Sorry for my misunderstanding. I just wanted to clarify that you do not HAVE to do it that way. Perhaps you did once - though it sounds rather weak from a security standpoint.

/k

0 Karma

ephemeric
Contributor

No. What I'm saying is there is a gaping security hole in the article.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...