Secure your deployment server and clients using certificate authentication
Authentication using signed certificates between deployment servers and clients is not recommended or considered necessary. The configuration data pushed from the deployment server to client does not generally provide exploitable information. In addition, there are risks in configuring certificate authentication for a deployment server and clients:
- Splunk Web will fail to authenticate unless you also configure it to use the certificate.
- The CLI will be not be able to communicate with the deployment server.
You may find certificate authentication necessary in certain distributed configurations, perhaps where extremely sensitive server configuration data is sent to a variety of locations outside your firewall. You can manually configure each indexer to communicate with your Deployment Server:
1. Create one or more certificates using the same root CA.
2. Distribute the certificates to your deployment server and clients.
server.conf to provide the location of your certificates:
[sslConfig] enableSplunkdSSL = true sslKeysfile = server.pem sslKeysfilePassword = password caCertFile = cacert.pem caPath = $SPLUNK_HOME/etc/auth
server.conf to authenticate against your certificates by adding the following attribute to the [sslConfig] stanza in previous step:
requireClientCert = true
requireClientCert is set to "false" by default. If you change it to true to force Splunk software to check your client's certificates, Splunk Web and the CLI will also be checked for certificates. Your CLI connection will no longer work because your CLI is unable to present a certificate as a client.
web.conf to present a certificate signed by the same root CA so that Splunk Web can connect to the server.
The following is an example of an edited settings stanza:
[settings] enableSplunkWebSSL = true privKeyPath = etc/auth/splunkweb/mySplunkWebPrivateKey.key serverCert = etc/auth/splunkweb/mySplunkWebCertificate.pem cipherSuite = <your chosen cipher suite (optional)>
Note: Splunk Web does not support passwords, so you must remove the password from the private key. For more information, see "Get certificates signed by a third party for Splunk Web."
Securing distributed search heads and peers
Use Splunk Enterprise to audit your system activity
This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15, 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.1.14, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14