Splunk® Enterprise

Securing Splunk Enterprise

Splunk Enterprise version 7.2 is no longer supported as of April 30, 2021. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.

Configure SSL and TLS protocol version support for secure connections between Splunk platform instances

You can control the individual versions of SSL or TLS protocol that Splunk Enterprise is to support for secure communications between Splunk platform instances. You perform this configuration using the sslVersions setting in various configuration files.

You can use the setting to restrict or support older versions of protocols. When you configure the sslVersions setting in a configuration file, Splunk Enterprise either makes or accepts connections using the protocol versions you specify. Both the instance that makes the connection and the instance that receives the connection must support the same protocol versions.

You must always configure this setting in a configuration file. It's not possible to perform this configuration in Splunk Web.

Supported SSL and TLS protocol versions

The Splunk platform supports the following SSL and TLS versions:

  • SSLv2
  • SSLv3
  • TLS1.0
  • TLS1.1
  • TLS1.2

The SSL* protocol versions are not secure because of various exploits that can take advantage of those protocols. Don't use these protocols unless you have no other option. Instead, use the TLS* versions wherever possible. You can use the special tls value to specify all available TLS versions. If you enable Federal Information Processing Standards (FIPS) mode on Splunk Enterprise, it isn't possible to use the SSL* protocol versions. Splunk Enterprise won't communicate on these protocols when it is in FIPS mode even if you explicitly specify the protocols.

Configure SSL and TLS protocol version support with the sslVersions setting

The sslVersions setting controls the SSL and TLS protocols that each Splunk platform instance uses to connect to Other Splunk platform instances securely. The syntax for configuring the setting follows:

Action you want to perform Syntax Example
Specify a single protocol to support sslVersions=<protocol> sslVersions=tls1.0
Specify a single protocol to restrict sslVersions=-<protocol> sslVersions=-ssl2
Specify multiple protocols to support sslVersions=<protocol>,<protocol>,... sslVersions=tls1.0,tls1.1
Specify one or more protocols to support and one or more to restrict at the same time sslVersions=<protocol>,-<protocol>,[-]<protocol>,... sslVersions=-ssl2,-ssl3,tls1.0,tls1.1
Specify all protocol versions sslVersions=*
Specify all but one protocol version sslVersions=*,-<protocol> sslVersions=*,-ssl2
Specify all versions of TLS sslVersions=tls

Older versions of Splunk Enterprise and the universal forwarder might not support newer versions of SSL/TLS protocols, and vice versa. As a reminder, each instance in a network connection must support the protocol version you choose for secure connections between those instances to succeed. Confirm that both the connecting instance and the receiving instance support the protocol you want, and that you set the sslVersions setting on each instance to a value that both instances can use. If you enable FIPS mode on an instance, that instance won't use the SSL protocol versions at all

  1. Open the configuration file where you want to configure the protocol versions, depending on the instance type and the connection.
  2. Edit the sslVersions setting. Establish the versions you want to support or restrict by supplying the appropriate values.
  3. Save the configuration file and close it.
  4. Restart Splunk Enterprise for the changes to take effect.

Where you configure the sslVersions setting depends on the kind of communication that the Splunk platform instances are performing. The general procedure follows:

Service or instance performing connection Configuration file Notes
Splunk Web web.conf
Splunk forwarder inputs.conf The setting is available under many stanzas in the inputs.conf file, see the specification file for details on where you can configure the sslVersions setting.
Splunk indexer server.conf The setting is available under many stanzas in the server.conf file, see the specification file for details on where you can configure the sslVersions setting.
Splunkd as a client server.conf The sslVersionsForClient setting is used when the Splunk daemon acts as a client, for example, as a deployment client connecting to a deployment server, or as an indexer or search head cluster. In this case, the instance where the splunkd process connects must also be configured to listen over SSL. See the specification file for details on where you can configure the sslVersionsForClient and enableSplunkdSSLsettings.

Examples for configuring SSL/TLS protocol versions

See the following configuration examples to better understand how to configure SSL and TLS protocol versions between Splunk platform instances.

Example 1: Forwarder and receiver to communication on TLS 1.1

Forwarder, inputs.conf Receiver, server.conf
[SSL]
sslVersions=tls1.1
[sslConfig]
sslVersions=tls1.1
enableSplunkdSSL=true

Example 2: Splunk deployment client and deployment server on SSL v3 and all TLS protocols

Deployment client, server.conf Deployment server, server.conf
[sslConfig]
sslVersionsForClient=ssl3,tls
[sslConfig]
sslVersions=ssl3,tls
enableSplunkdSSL=true
Last modified on 14 February, 2023
About using SSL tools on Windows and Linux   About creating certificates for Splunk

This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.0.10, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.3.0, 9.3.1


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters