Secure Splunk Enterprise with FIPS

The Federal Information Processing Standard (FIPS) uses government-certified versions of some cryptographic algorithms to meet regulatory guidelines of the agencies of the United States federal government. Splunk Enterprise supports the use of FIPS mode to meet those guidelines. Enable FIPS mode if it is a regulatory requirement for your environment.

About Splunk Enterprise and the FIPS module

Splunk Enterprise and the universal forwarder use an embedded cryptographic FIPS module on various operating systems.

Security considerations for enabling FIPS mode

When you enable FIPS mode on Splunk Enterprise, you must understand the following:

• Do not consider enabling FIPS mode on Splunk Enterprise a security enhancement on its own. FIPS mode is one of several strategies you can employ to improve security for Splunk software.
• You must enable FIPS mode before you start Splunk Enterprise the first time. FIPS mode is active only when you enable it on a machine that runs a FIPS-compliant operating system kernel that is itself in FIPS mode. If you run Splunk Enterprise on a Linux machine that runs a kernel that is in FIPS mode, Splunk Enterprise enables FIPS mode automatically.
• Enabling FIPS mode can potentially reduce overall Splunk Enterprise performance.
• The FIPS module disables the use of some cryptographic algorithms in the instance of Python that Splunk software uses to run apps (such as Message Digest 5 (MD5) and Rivest Cipher 4 (RC4).
• Any Splunk apps that you want to run on a FIPS-enabled instance must be certified to run in FIPS mode and cannot have dependencies on algorithms like MD5 or RC4.

Enable FIPS mode on Splunk Enterprise

Always enable FIPS mode upon initial Splunk software installation. If you install the software without FIPS mode enabled, you cannot enable FIPS during an upgrade later, and must either reinstall, or install a new version.

1. Before you start Splunk Enterprise for the first time, use a text editor to edit the $SPLUNK_HOME/etc/splunk-launch.conf configuration file.
2. Add the following line to the file:

   SPLUNK_FIPS=1

3. Start Splunk Enterprise. The startup process enables FIPS mode during the installation.

Use indexes with FIPS enabled

Running Splunk Enterprise in FIPS mode does not alter indexed data in any way. You can copy indexes between FIPS and non-FIPS indexers.

Confirm FIPS mode status

You can use the CLI, a REST endpoint, or a Splunk search to determine whether or not the Splunk instance is in FIPS mode.

The following CLI command returns FIPS mode status:

splunk show fips-mode -auth <username>:<password>

• If FIPS mode is enabled, the CLI command returns FIPS mode enabled.
• Otherwise, it returns FIPS mode disabled.

The following REST call returns FIPS mode status:

curl -s -k -u admin:changeme https://localhost:8089/services/server/info | grep fips_mode

If FIPS mode is enabled, this call returns the following:

<s:key name="fips_mode">1</s:key>

The following Splunk search returns FIPS mode status:

"| rest splunk_server=local /services/server/info | fields fips_mode"

If FIPS mode is enabled, the search returns the following:

fips_mode
---------
        1

Troubleshoot FIPS mode

• If your Splunk Enterprise instance is in FIPS mode and the Rivest-Shamir-Adelman (RSA) encrypted private keys that you usually use do not work, those keys might be incompatible with FIPS. To mitigate this issue, you can convert your Privacy Enhanced Mail (PEM) private key to the Public Key Cryptography Standards #8 (PKCS 8) format to make them compatible.

• After you install Splunk software without FIPS mode enabled, you cannot later enable FIPS mode, even during an upgrade. If you require FIPS compliance, confirm that your initial Splunk Enterprise installation is FIPS-enabled. To change to a version running FIPS mode, reinstall Splunk Enterprise and use the procedure in this topic to enable FIPS.

• If you have problems running a Splunk app, confirm that it is certified to run in FIPS mode and does not have dependencies on cryptographic algorithms that FIPS disables, such as MD5 and RC4.