Getting Data In

system sslPassword not hashing

sloshburch
Splunk Employee
Splunk Employee

My universal fowarders are not hashing the sslPassword file stored at the etc/system location after restart. Instead, the hash is being created in a new outputs.conf in the SplunkUniversalForwarder local folder but still leaving the unhashed value in the etc/system/local/outputs.conf. I specifically moved the ssl config to etc/system because of the limitation of apps being unable to hash the sslPassword attribute.

Please help me make sure my sslPassword is hashed?

Config highlights:
This is the file after a restart:
/opt/splunkforwarder/etc/system/local/outputs.conf
[tcpout]
defaultGroup = splunk
sslCertPath = $SPLUNK_HOME/etc/auth/server.pem
sslPassword = password
sslRootCAPath = $SPLUNK_HOME/etc/auth/cacert.pem

(pulled from deployment server)
/opt/splunkforwarder/etc/apps/forwardingPropsToProdSplunk/default
[tcpout:splunk]
server = <hostname>:<port> #Replaced for posting in this forum
forwardedindex.0.whitelist = _internal

This is what is generated:
/opt/splunkforwarder/etc/apps/SplunkUniversalForwarder/local/outputs.conf
[tcpout]
dnsResolutionInterval = 300
sslPassword = $1$wlv2PW4J2Hah
useClientSSLCompression = true

0 Karma
1 Solution

sloshburch
Splunk Employee
Splunk Employee

It turns out that the sslPassword can only be hashed when it is in an outputs.conf in a local folder.

Support believes that the following two statements in the outputs.conf documentation are incorrect (but they are looking into it to be sure):

  • Starting with 4.2, the [tcpout] stanza is no longer required.
  • Starting with 4.2, this attribute is no longer required.

I was able to put the sslPassword in the outputs file in the local folder of an app that I use to specify the indexer and ssl configuration and the sslPassword autohash on the forwarders side when the forwarder restarted.

View solution in original post

sloshburch
Splunk Employee
Splunk Employee

It turns out that the sslPassword can only be hashed when it is in an outputs.conf in a local folder.

Support believes that the following two statements in the outputs.conf documentation are incorrect (but they are looking into it to be sure):

  • Starting with 4.2, the [tcpout] stanza is no longer required.
  • Starting with 4.2, this attribute is no longer required.

I was able to put the sslPassword in the outputs file in the local folder of an app that I use to specify the indexer and ssl configuration and the sslPassword autohash on the forwarders side when the forwarder restarted.

sloshburch
Splunk Employee
Splunk Employee

I am using a deployment server. I merely showed the resulting forwarder. Ideally I would be able to use the DS to push the cert info but the result is that the deployed app will not have a hashed password value after restart. I do understand config file precedence in the sense that I undersand the more specific wins over the more general (app vs system).

Does that help clarify? Sorry if my prior post was unclear. Thanks for your help on this.

0 Karma

bmacias84
Champion

I am sorry I confused as to why you are not using deployment server to deploy an app with all those settings. Also do you under stand config file precedence? I am currently doing what you want I'd be happy to detail its lay out. I also think I know why your password is not hashing correctly.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...