Security

SSL Versions for tcp-ssl input ignored

tiagofbmm
Influencer

I'm trying to get Splunk to accept SSLv3 for a special case of tcp-ssl input, and although specifying sslVersions = "ssl3", nmap --script ssl-enum-ciphers localhost -p 9998 always returns TLSv1.2 as the only one accepted... any ideas why is my parameter ignored?

Starting Nmap 7.60 at 2019-03-01 08:53 GMT
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000049s latency).

PORT     STATE SERVICE
9998/tcp open  distinct32
| ssl-enum-ciphers:
|   TLSv1.2:
0 Karma
1 Solution

tiagofbmm
Influencer

Support for earlier TLS versions than v1.2 requires adding more cipherSuites, so now I have support for all the versions ( it's actually intended for earlier than Splunk 5.x versions compatibility, but get;s me what I want anyway)

[SSL]
rootCA = $SPLUNK_HOME/etc/auth/cacert.pem
serverCert = $SPLUNK_HOME/etc/auth/server.pem
sslVersions = tls
cipherSuite = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:AES256-SHA:DHE-RSA-AES128-SHA:AES128-SHA:AES256-SHA:AES128-SHA

View solution in original post

0 Karma

tiagofbmm
Influencer

Support for earlier TLS versions than v1.2 requires adding more cipherSuites, so now I have support for all the versions ( it's actually intended for earlier than Splunk 5.x versions compatibility, but get;s me what I want anyway)

[SSL]
rootCA = $SPLUNK_HOME/etc/auth/cacert.pem
serverCert = $SPLUNK_HOME/etc/auth/server.pem
sslVersions = tls
cipherSuite = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:AES256-SHA:DHE-RSA-AES128-SHA:AES128-SHA:AES256-SHA:AES128-SHA

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

Can you please try to connect with openssl command as given below

/opt/splunk/bin/splunk cmd openssl s_client -connect localhost:9998 -ssl3

If it will generate error as given below then it means that it is not accepting traffic on sslv3

CONNECTED(00000003)
140269635843760:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:s3_pkt.c:1498:SSL alert number 40
140269635843760:error:1409E0E5:SSL routines:ssl3_write_bytes:ssl handshake failure:s3_pkt.c:659:
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...