Splunk® Enterprise

Securing Splunk Enterprise

Download manual as PDF

Download topic as PDF

Secure your deployment server and clients using certificate authentication

Authentication using signed certificates between deployment servers and clients is not recommended, because the configuration data pushed from the deployment server to client does not generally provide exploitable information. Configuring certificate authentication for a deployment server and clients impacts the rest of your configuration as follows:

  • Splunk Web will fail to authenticate unless you also configure it to use the certificate.
  • The CLI will be not be able to communicate with the deployment server.

You may find certificate authentication necessary in certain distributed configurations, perhaps where extremely sensitive server configuration data is sent to a variety of locations outside your firewall. You can manually configure each indexer to communicate with your Deployment Server:

Note: The deployment server cannot properly push certificates to peers. You must configure each member separately.

1. Create one or more certificates using the same root CA.

2. Distribute the certificates to your deployment server and clients.

3. Edit server.conf to provide the location of your certificates:

[sslConfig]

enableSplunkdSSL = true

sslVersions = Defaults to "*,-ssl2" (anything newer than SSLv2). This is the recommended setting.

serverCert =  The full path to the PEM format server certificate file. Default certificates 
($SPLUNK_HOME/etc/auth/server.pem) are generated by Splunk at start. To secure Splunk, 
you should replace the default cert with your own PEM file.

sslPassword = password

sslRootCAPath = absolute path to the operating system's root CA (Certificate Authority) PEM 
format file containing one or more root CA. Do not configure this attribute on Windows.

4. Edit server.conf to authenticate against your certificates by adding the following attribute to the [sslConfig] stanza in previous step:

requireClientCert = true

Important: This requireClientCert is set to "false" by default. If you change it to true to force Splunk to check your client's certificates, Splunk Web and the CLI will also be checked for certificates. Your CLI connection will no longer work because your CLI is unable to present a certificate as a client.

5. Edit web.conf to present a certificate signed by the same root CA so that Splunk Web can connect to the server.

The following is an example of an edited settings stanza:

[settings]
enableSplunkWebSSL = true
privKeyPath = etc/auth/splunkweb/mySplunkWebPrivateKey.key
serverCert = etc/auth/splunkweb/mySplunkWebCertificate.pem
cipherSuite = <your chosen cipher suite (optional)>

Note: Splunk Web does not support passwords, so you must remove the password from the private key. For more information, see "Get certificates signed by a third party for Splunk Web."

PREVIOUS
Securing distributed search heads and peers
  NEXT
Secure your clusters with pass4SymmKey

This documentation applies to the following versions of Splunk® Enterprise: 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6


Comments

Hi Norbert,hamel,

I think what this means is that you can't use the DS to push single certificate files to deployment clients. I will confirm this and advise. Thanks.

Malmoore, Splunker
May 17, 2019

I do not understand "The deployment server cannot properly push certificates to peers." When I place my certificates into an app, the DS can of course deploy them to the clients.

Norbert.hamel
May 14, 2019

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters