Splunk Enterprise 8.x for Linux STIG

Splunk Enterprise 8.x for Linux Security Technical Implementation Guide

The Splunk Enterprise 8.x for Linux Security Technical Implementation Guide (V2 R2) has 36 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

36STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R2

CurrentPublished Wed Apr 02 2025 What changed in V2R2

Splunk Enterprise must use organization-level authentication to uniquely identify and authenticate users.

Splunk Enterprise 8.x for Linux Security Technical Implementation Guide

Assessment Title

Rule Text

Splunk Enterprise must use organization-level authentication to uniquely identify and authenticate users.

Description

Discussion Text

To assure accountability and prevent unauthenticated access, organizational users must be uniquely identified and authenticated to prevent potential misuse and compromise of the system.

Sharing of accounts prevents accountability and non-repudiation. Organizational users must be uniquely identified and authenticated for all accesses.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-251679

Rule

SV-251679r1051115_rule

Severity

high

Rule Version

SPLK-CL-000320

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

This check is performed on the machine used as a search head or a deployment server, which may be a separate machine in a distributed environment.

Navigate to the $SPLUNK_HOME/etc/system/local/ directory.

View the authentication.conf file.

If the authentication.conf file does not exist, this is a finding.

In the authentication.conf file, verify minimum settings similar to the example below. If any minimum settings are not configured, this is a finding.

If using LDAP:

[authentication]
authType = LDAP
authSettings = <ldap_strategy>

[<ldap_strategy>]
host = <LDAP server>
port = <LDAP port>
sslEnabled = 1

Check the following file in the $SPLUNK_HOME/etc/openldap folder:

ldap.conf

If the file does not exist, this is a finding.

Check for the following lines. If any are missing or do not match the settings below, this is a finding.

TLS_REQCERT
TLS_CACERT <path to SSL certificate>
TLS_PROTOCOL_MIN 3.3
TLS_CIPHER_SUITE ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-
SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-
AES128-SHA256:ECDHE-RSA-AES128-SHA256

If using SAML:

[authentication]
authType = SAML
authSettings = <saml_strategy>
[<saml_strategy>]
entityId = <saml entity>
idpSSOUrl = <saml URL>
idpCertPath = <path to certificate>

Open the Splunk Web console.

Select Settings >> Access Controls >> Users. 

Verify that no user accounts exist with Authentication system set to Splunk except an account of last resort. They must all be set to LDAP or SAML.

If any user accounts have Authentication system set to Splunk, with the exception of one emergency account of last resort, this is a finding.

Implementation Procedure

Fix Text

This configuration is performed on the machine used as a search head or a deployment server, which may be a separate machine in a distributed environment.

Navigate to the $SPLUNK_HOME/etc/system/local/ directory.

Edit the authentication.conf file.

If the authentication.conf file does not exist, copy the file from $SPLUNK_HOME/etc/system/default to the $SPLUNK_HOME/etc/system/local directory.

Configure minimum settings similar to the example below for using LDAP or SAML.

If using LDAP:

[authentication]
authType = LDAP
authSettings = <ldap_strategy>

[<ldap_strategy>]
host = <LDAP server>
port = <LDAP port>
sslEnabled = 1

Edit the following file in the $SPLUNK_HOME/etc/openldap folder:

ldap.conf

Configure the following lines for your certificate.

TLS_REQCERT
TLS_CACERT <path to SSL certificate>
TLS_PROTOCOL_MIN 3.3
TLS_CIPHER_SUITE ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-
SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-
AES128-SHA256:ECDHE-RSA-AES128-SHA256

If using SAML:

[authentication]
authType = SAML
authSettings = <saml_strategy>
[<saml_strategy>]
entityId = <saml entity>
idpSSOUrl = <saml URL>
idpCertPath = <path to certificate>

After configuring LDAP or SAML, open the Splunk Web console.

Select Settings >> Access Controls >> Users. 

Create appropriate LDAP and SAML users and groups for the environment.

Delete any user account with Authentication system set to Splunk, with the exception of one emergency account of last resort. Splunk will prevent the user from deleting an LDAP or SAML account.

STIG check 23 of 36 in the Splunk Enterprise 8.x for Linux STIG checklist

← Previous · V-251678When Splunk Enterprise is distributed over multiple servers, each server must be configured to disable non-essential capabilities.Next · V-251680 →Splunk Enterprise must use HTTPS/SSL for access to the user interface.