Secure Splunk Enterprise with FIPS

The Federal Information Processing Standards (FIPS) are a collection of standards that govern the requirements for security and interoperability on computer systems to meet the regulatory guidelines of the agencies of the United States federal government. The National Institute of Standards and Technology (NIST) developed FIPS to provide, among other things, the specifications for the distribution of some cryptographic algorithms for those computer systems. FIPS Publication Nos. 140-2 and 140-3 provide specific guidance on the use of cryptographic modules.

Splunk supports FIPS Publication No. 140-2 in the context of providing FIPS functionality for Splunk Enterprise. Splunk Enterprise supports the use of FIPS mode to meet FIPS guidelines, and includes a module that complies with FIPS. Enable FIPS mode on Splunk Enterprise if it is a regulatory requirement for your environment, for example, if you are a contractor of the United States government and have a requirement to comply with FIPS.

For additional information on Splunk support for FIPS compliance, you can visit the Splunk Compliance page.

About Splunk Enterprise and the FIPS module

Splunk Enterprise and the universal forwarder use an embedded cryptographic FIPS module. This module, known as Certificate #4990, is available to activate for the Linux and Windows operating systems.

When you turn on FIPS mode for Splunk Enterprise, the software uses this module to ensure that cryptologic functions operate to FIPS standards. It disables algorithms that do not comply with those standards.

Security considerations for enabling FIPS mode

When you enable FIPS mode on Splunk Enterprise, you must understand the following considerations and caveats:

• Do not consider enabling FIPS mode on Splunk Enterprise a security enhancement on its own. FIPS mode is one of several strategies you can employ to improve security for Splunk software.
• FIPS mode works only if the operating system on which you run Splunk Enterprise also runs in FIPS mode. See the documentation for your operating system for instructions on how to activate FIPS mode for it.
• You must turn on FIPS mode before you start Splunk Enterprise the first time. FIPS mode is active only when you enable it on a machine that runs a FIPS-compliant operating system kernel that is itself in FIPS mode. If you run Splunk Enterprise on a Linux machine that runs a kernel that is in FIPS mode, Splunk Enterprise turns on FIPS mode automatically.
• Turning on FIPS mode can potentially reduce overall Splunk Enterprise performance.
• The FIPS module disables the use of some cryptographic algorithms in the instance of Python that Splunk software uses to run apps (such as Message Digest 5 (MD5) and Rivest Cipher 4 (RC4).
• Any Splunk apps that you want to run on a FIPS-enabled instance must be certified to run in FIPS mode and cannot have dependencies on algorithms like MD5 or RC4.

Turn on FIPS mode in Splunk Enterprise

Always turn on FIPS mode when you first install Splunk software. If you install the software without FIPS mode turned on, you cannot turn it on during an upgrade later, and must either reinstall, or install a new version of the software.

1. Before you start Splunk Enterprise for the first time, use a text editor to edit the $SPLUNK_HOME/etc/splunk-launch.conf configuration file.
2. Add the following line to the file:

   SPLUNK_FIPS=1

3. Start Splunk Enterprise. The startup process enables FIPS mode during the installation.

Use indexes with FIPS mode turned on

A Splunk Enterprise instance that operates in FIPS mode neither alters the data it has indexed nor changes how it handles that data in any way. You can copy indexes between FIPS and non-FIPS indexers.

Confirm FIPS mode status

You can use the Splunk CLI, a REST endpoint, or a Splunk search to determine whether or not the Splunk instance is in FIPS mode.

The following CLI command returns FIPS mode status:

splunk show fips-mode -auth <username>:<password>

• If FIPS mode is on, the CLI command returns FIPS mode enabled.
• Otherwise, it returns FIPS mode disabled.

The following REST call returns FIPS mode status:

curl -s -k -u admin:changeme https://localhost:8089/services/server/info | grep fips_mode

If FIPS mode is on, this call returns the following:

<s:key name="fips_mode">1</s:key>

The following Splunk search returns FIPS mode status:

"| rest splunk_server=local /services/server/info | fields fips_mode"

If FIPS mode is on, the search returns the following:

fips_mode
---------
        1

Troubleshoot Splunk Enterprise in FIPS mode

• If your Splunk Enterprise instance is in FIPS mode and the Rivest-Shamir-Adelman (RSA) encrypted private keys that you usually use do not work, those keys might be incompatible with FIPS. To mitigate this issue, you can convert your Privacy Enhanced Mail (PEM) private key to the Public Key Cryptography Standards #8 (PKCS 8) format to make them compatible.

• After you install Splunk software without FIPS mode enabled, you cannot later enable FIPS mode, even during an upgrade. If you require FIPS compliance, confirm that your initial Splunk Enterprise installation is FIPS-enabled. To change to a version running FIPS mode, reinstall Splunk Enterprise and use the procedure in this topic to enable FIPS.

• If you have problems running a Splunk app, confirm that it is certified to run in FIPS mode and does not have dependencies on cryptographic algorithms that FIPS disables, such as MD5 and RC4.