Splunk Enterprise must use LDAPS for the LDAP connection.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-221609	SPLK-CL-000080	SV-221609r961029_rule		High

Description
Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Securing the connection to the LDAP servers mitigates this risk.

STIG	Date
Splunk Enterprise 7.x for Windows Security Technical Implementation Guide	2024-06-10

Details

Check Text ( C-23324r663929_chk )
If the instance being checked is in a distributed environment and has the web interface disabled, this check is N/A. If using SAML for authentication, this check is N/A. Select Settings >> Access Controls >> Authentication method. Select LDAP Settings. Select the LDAP strategy and verify that SSL enabled is checked and the Port is set to 636. If SSL enabled is not checked, and Port is not 636, this is a finding.

Check Text ( C-23324r663929_chk )

If the instance being checked is in a distributed environment and has the web interface disabled, this check is N/A.

If using SAML for authentication, this check is N/A.

Select Settings >> Access Controls >> Authentication method.

Select LDAP Settings.

Select the LDAP strategy and verify that SSL enabled is checked and the Port is set to 636.

If SSL enabled is not checked, and Port is not 636, this is a finding.

Fix Text (F-23313r416285_fix)
If using SAML for authentication, this fix is N/A. Select Settings >> Access Controls >> Authentication method. Select LDAP Settings. Select the LDAP strategy and check the option SSL enabled. Set Port to 636. Edit the following file in the installation to configure Splunk to use SSL certificates: $SPLUNK_HOME/etc/openldap/ldap.conf Add the following line: TLS_CACERT