Getting Data In

How to encrypt password in app outputs.conf?

karlbosanquet
Path Finder

I am deploying Indexer Cluster settings in an app to multiple Universal Forwarders via the Deployment Server. The issue I have is that they require the Indexer Cluster password to be sent in the /local/outputs.conf file.

App deployment works fine and a new outputs.conf is created on the Universal Forwarder under $SPLUNK_HOME/etc/system/local with the required stanza and encrypted password.

The issue is that the password exists in clear text in 2 places;

Deployment Server - $SPLUNK_HOME/etc/deployment_apps/app_name/local/outputs.conf

Universal Forwarder - $SPLUNK_HOME/etc/apps/app_name/local/outputs.conf

Is there a way for the password to be encrypted at all locations?

Richfez
SplunkTrust
SplunkTrust

This problem seems to be known. Read this section on the docs and it mentions this specifically. It also gives a sort of workaround, too:

Warning: If you configure inputs.conf or outputs.conf in an app directory, the password is NOT encrypted and the clear-text value remains in the file. For this reason, you may prefer to create different certificates (signed by the same root CA) to use when configuring SSL in app directories.

By adding this answer the question will pop up to the top of the stack, so maybe someone else will have a better answer.

karlbosanquet
Path Finder

My current solution is a script which pushes the pass4SymmKey password out to Universal Forwarders, then I deploy an empty app from the Deployment Server called 'restart' with the restart services flag checked which restarts the UF service on all of the UFs, which hashes the password.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...