Getting Data In

deploy server.conf via deployment server and point individual ssl certs

leonaheidern
New Member

hi all

I am a splunk noob.

I have created individual server.pem files that are sha256 compliant from my windows ca

my deployment server and clients are mostly windows

the clients ( servers with universalforwarder installed) were individually installed.

my environment is using 6.5.3

i am trying to push a hardened server.conf with the sslconfig pointing to each individual servers pem file from the deployment server.

Is there any way i can do that

e.g. in the deploymentserver\etc\deployment-apps\appname\local\server.confs

can i put the server.conf file this way?

[general]
servername= server1

[sslconfig]
allowsslcompression=false
sslversions = tls1.1, tls1.2
requireclientcert=false
enablesplunkdssl=true
sslkey files=server1.pem
sslkeysfilepassword=password
caPath=$splunk_home\etc\auth
sslPassword=password

[general]
servername= server2

[sslconfig]
allowsslcompression=false
sslversions = tls1.1, tls1.2
requireclientcert=false
enablesplunkdssl=true
sslkey files=server2.pem
sslkeysfilepassword=password
caPath=$splunk_home\etc\auth
sslPassword=password

0 Karma

leonaheidern
New Member

Hi garethatiag

I do not understand

I am trying to push the individual pem files for my clients on the deployment server to the client servers. plus edit the indivdual client server's server.conf to point to the respective cert.

do i edit the put these files in the deployment server's splunk_home\etc\deployment-apps\myserverconfigindexgroup\server1.pem to push the pem certificate for server1.pem down to server1?

0 Karma

gjanders
SplunkTrust
SplunkTrust

If your happy with all your clients using a common SSL file then pushing from the deployment server is going to be an easy way to do this...

0 Karma

gjanders
SplunkTrust
SplunkTrust

The documentation for securing Splunk with SSL in particular the section about securing the deployment server and clients

You do not need to override all the configuration, only the relevant parts that you are changing as per the documentation...

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...