Securing Splunk Enterprise with FIPS
The Federal Information Processing Standard (FIPS) uses government-certified versions of some algorithms to meet regulatory guidelines. It should not be considered a security enhancement by itself, and might potentially reduce performance on your system. Enable FIPS if it is a regulatory requirement for your environment.
Splunk Enterprise and the Universal Forwarder use an embedded FIPS 140-2-validated cryptographic module (Certificate #3126 Module Version fips-2.0.12) running on various platforms per FIPS 140-2 Implementation Guidance section G.5 guidelines.
- The certificate is listed on the National Institute of Standards and Technology (NIST) site. See Certificate Detail | Cryptographic Module Validation Program
- See the consolidated validation certificate also on the NIST website.
Key points to enabling FIPS
There are several things that you must understand when you enable FIPS on Splunk Enterprise:
- You must enable FIPS mode before you start Splunk Enterprise. FIPS mode is disabled except when it runs on a Linux machine that runs a kernel in FIPS mode.
- FIPS is automatically enabled if you run Splunk software on a Linux machine that runs a kernel in FIPS mode.
- The FIPS module disables the use of some cryptographic algorithms in the instance of Python that Splunk software uses to run apps (such as Message Digest 5 (MD5) and Rivest Cipher 4 (RC4).
- Any Splunk apps you want to run on a FIPS-enabled instance must be certified to run in FIPS mode and cannot have dependencies on algorithms like MD5 or RC4.
Always enable FIPS mode upon initial Splunk software installation. If you install the software without FIPS mode enabled, you cannot later upgrade it to a FIPS version, and must either reinstall, or install a new version.
- Before you start Splunk Enterprise for the first time, use a text editor to edit the
- Add the following line to the file:
- Start Splunk software. It enables FIPS mode during the installation.
Use indexes with FIPS enabled
Running Splunk in FIPS mode does not alter indexed data in any way. You can copy indexes between FIPS and non-FIPS indexers.
Confirm FIPS mode status
You can use the CLI, a REST endpoint, or Splunk search to determine whether or not the Splunk instance is in FIPS mode.
The following CLI command returns FIPS mode status:
splunk show fips-mode -auth <username>:<password>
- If FIPS mode is enabled, the CLI command returns
FIPS mode enabled.
- Otherwise, it returns
FIPS mode disabled.
The following REST call returns FIPS mode status:
curl -s -k -u admin:changeme https://localhost:8089/services/server/info | grep fips_mode
If FIPS mode is enabled, this call returns the following:
The following Splunk search returns FIPS mode status:
"| rest splunk_server=local /services/server/info | fields fips_mode"
If FIPS mode is enabled, the search returns the following:
fips_mode --------- 1
- If you are in FIPS mode and your usual RSA encrypted private keys do not work, they might be incompatible with FIPS. To mitigate this issue, you can convert your Privacy Enhanced Mail (PEM) private key to PKCS#8 format to make them compatible.
- After you install Splunk software without FIPS mode enabled, you cannot enable FIPS mode. If you require FIPS compliance, confirm that your initial Splunk installation is FIPS-enabled. To change to a version running FIPS mode, reinstall Splunk software and use the procedure in this topic to enable FIPS.
- If you have problems running a Splunk app, confirm that it is certified to run in FIPS mode and does not have dependencies on cryptographic algorithms that FIPS disables (such as MD5 and RC4).
About TLS encryption and cipher suites
About default certificate authentication
This documentation applies to the following versions of Splunk® Enterprise: 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.2.0, 8.2.1