How to configure SSL for forwarding and receiving data

Question

We are running Splunk V3, but are spinning up a new Splunk V4 server, which we will migrate to. We will likely only migrate some saved searches and reports, not existing log data.

I'm configuring SSL for encryption only (at this point), between a forwarder and the receiver. I have been following the docs, but would like some help.

Do customers typically configure SSL using certificates they have created, or using the certificate which Splunk generates at install (E.G. /opt/splunk/etc/auth/server.pem)? IF we use a certificate which we create, do we need to self-sign that certificate, and tell the Splunk receiver and the forwarder about that CA?

I wasn't sure what the password was for the Splunk generated cert, so I created my own cert. I am currently getting this error on the receiver:

01-14-2010 17:13:20.711 INFO TcpInputProc - Connection in cooked SSL mode from IP=selma.cair.du.edu
01-14-2010 17:13:20.712 ERROR TcpInputFd - SSL Error = error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca
01-14-2010 17:13:20.712 ERROR TcpInputFd - SSL Error for fd from HOST:selma.cair.du.edu, IP:130.253.1.77, PORT:33212

Here are my current configuration changes...

On the receiver, /opt/splunk/etc/system/local/inputs.conf:

[default]
host = splunk4
# ifetch: Require SSL, for encryption but not auth, for forwarders
[SSL]
serverCert=$SPLUNK_HOME/etc/system/local/9996.pem
requireClientCert=false
[splunktcp-ssl:9996]
# I am not specifying a queue here, do I need to?

ON the forwarder, /opt/splunk/etc/system/local/outputs.conf:

[tcpout-server://splunk4.cair.du.edu:9996]
sslCertPath=$SPLUNK_HOME/etc/system/local/selma.pem
sslVerifyServerCert=false

Thanks,

Accepted Answer

Most people use the Splunk ones, which is plenty to stop casual eavesdropping, though of course a hardworking and informed snooper can get hold of the Splunk CA (since it comes with every download of Splunk) and try to use that to decrypt captured traffic.

If you have your own certificate, you need the cert with its corresponding private key embedded (same as for a web server), plus you need to have the signing CA public cert.

The following configuration works with the default Splunk certs. The passwords for the generated server certificate private key (server.pem) is literally password. (That happens to be the same password as used for the shipped CA's (ca.pem) signing private key.) We do not need to use ca.pem here, we only need the public key of the signing CA, which is in cacert.pem. cacert.pem is simply ca.pem, but without the private key.

Indexer:

[splunktcp-ssl:9998]
compressed = true

[SSL]
serverCert = $SPLUNK_HOME/etc/auth/server.pem
password = password
requireClientCert = false

Forwarder:

[tcpout]
defaultGroup = splunkindexer

[tcpout:splunkindexer]
server = splunkindexer001:9998
compressed = true

[tcpout-server://splunkindexer001:9998]
sslCertPath = $SPLUNK_HOME/etc/auth/server.pem
sslRootCAPath = $SPLUNK_HOME/etc/auth/cacert.pem
sslVerifyServerCert = false
sslPassword = password

To be honest, I don't see why the Forwarder needs to have sslCertPath or sslPassword set, since the Indexer has requireClientCert = false and doesn't have the CA configured at all, but it won't work without it. This might be a bug. (It's basically a waste of time to authorize clients with the default CA, since every Splunk forwarder in the world has a cert signed by that one.)

If using your own certificate, you would replace server.pem with server certificates (which may be different between Forwarder and Indexer), password (on both sides) with the corresponding password for the server.pem, and cacert.pem with your CA's public key certificate.

How to configure SSL for forwarding and receiving data

Follow this question

Splunk Resources

Related questions