Security

Why is the SDEE script showing my user/pass?

XenoPhage
Engager

I think it's ironic to see a security plugin doing something insecurely.. Anyway, here's a rough hack to fix this. Instead of showing the username and password in both the manager->data inputs->scripts section as well as the processlist on the server itself, this reads the username and password from a text file.

Note : This is a hack and not meant to be a final solution. I'm not sure how to modify the setup scripts yet, but it would be much nicer if the final solution were to generate these password files on the fly or give the user the option to use password files or put the data directly in the CLI command.

# Place this code at the bottom of the get_ips_feed.py.
# Comment out the last run() command in that file (it should be the last line)
# and append the following :

#run(sys.argv[1],sys.argv[2],sys.argv[3],"https","yes")

passwd_conf = '/opt/splunk/etc/apps/Splunk_CiscoIPS/local/.ids_passwd'
username = ""
password = ""

try:
        f = open(passwd_conf, 'r')
        user_passwd_arr = f.readline().strip().split(':')
        f.close()
        if (len(user_passwd_arr) != 2):
                sys.exit("The file "+ passwd_conf +" has the wrong syntax")
        else:
                username = user_passwd_arr[0]
                password = user_passwd_arr[1]
except OSError:
        sys.exit("The file "+ passwd_conf +" could not be opened")

run(username,password,sys.argv[3],"https","yes")
Tags (3)

XenoPhage
Engager

Agreed, however I'm not sure there was an alternative pre splunk 4.2. I'm not familiar with the endpoint in 4.2 yet, so I'm looking forward to seeing how this will work.

0 Karma

jhansen
Splunk Employee
Splunk Employee

The current published release is intended to provide backward compatibility with Splunk 4.1.x, which doesn't include the new endpoint. The next maintenance release of the app should include this. Keep an eye out.

0 Karma

dart
Splunk Employee
Splunk Employee

There is an endpoint in 4.2 for storing credentials, which the SDEE app will likely be updated to use.

See this other question

southeringtonp
Motivator

Great suggestion and proof of concept. One nitpick though - personally, I'd lean against credentials in a hidden file. Security by obscurity and all that.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...