STIGQter: STIG Summary: Splunk Enterprise 7.x for Windows Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 23 Apr 2021:

Splunk Enterprise must use LDAPS for the LDAP connection.

DISA Rule

SV-221609r663930_rule

Vulnerability Number

V-221609

Group Title

SRG-APP-000172-AU-002550

Rule Version

SPLK-CL-000080

Severity

CAT I

CCI(s)

• CCI-000197 - The information system, for password-based authentication, transmits only cryptographically-protected passwords.

Weight

10

Fix Recommendation

If using SAML for authentication, this fix is N/A.

Select Settings >> Access Controls >> Authentication method.

Select LDAP Settings.

Select the LDAP strategy and check the option SSL enabled.

Set Port to 636.

Edit the following file in the installation to configure Splunk to use SSL certificates:

$SPLUNK_HOME/etc/openldap/ldap.conf

Add the following line:

TLS_CACERT <path to the DoD approved certificate in PEM format>

Check Contents

If the instance being checked is in a distributed environment and has the web interface disabled, this check is N/A.

If using SAML for authentication, this check is N/A.

Select Settings >> Access Controls >> Authentication method.

Select LDAP Settings.

Select the LDAP strategy and verify that SSL enabled is checked and the Port is set to 636.

If SSL enabled is not checked, and Port is not 636, this is a finding.

Vulnerability Number

V-221609

Documentable

False

Rule Version

SPLK-CL-000080

Severity Override Guidance

If the instance being checked is in a distributed environment and has the web interface disabled, this check is N/A.

If using SAML for authentication, this check is N/A.

Select Settings >> Access Controls >> Authentication method.

Select LDAP Settings.

Select the LDAP strategy and verify that SSL enabled is checked and the Port is set to 636.

If SSL enabled is not checked, and Port is not 636, this is a finding.

Check Content Reference

M

Target Key

4082

Comments