Security

admin password reset back to default? bug?

Michael
Contributor

I have three indexers in a cluster. We're in the process of taking them offline, in turn, for updates. They are running 6.5.1, we are updating them to 6.5.3.

So, I go to take the first one offline and the admin password does not work. On a whim, I tried the default "changeme" and it worked! The last time we did an update it went from 6.5.0 to 6.5.1. Those are the facts, but the assumption is that it got reset when updating to 6.5.1...?

I've been using Splunk for a half-dozen years, and never seen it reset it's admin password back to default...

Thoughts? Bug? Or, just another one of those snowflake things at my site that no one else has ever seen? 😉

Michael

0 Karma

mattymo
Splunk Employee
Splunk Employee

How did you do the upgrade? tar? rpm?

Like Muebel said, my guess is etc/passwd got moved or overwritten

- MattyMo
0 Karma

Michael
Contributor

Ah, that may be it, the sys-admin for the box is using Salt... when check and get back...

0 Karma

muebel
SplunkTrust
SplunkTrust

Hi Michael,

The admin passwd can get set to default if the etc/passwd file in splunk's installation directory is cleared. Perhaps this is what happened?

Past that, my only readily available explanation is that it was never set to begin with.

If neither of these fit, yeah, file a P4 with support and see if they have any advice.

Please let me know if this answers your question! 😄

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...