Deployment Architecture

encrypt my password in the configuration across servers with puppet/deployment server

mataharry
Communicator

I have multiple indexers, and a deployment server.
When I deploy my custom configuration files, if they contain a passwords in clear, they are modified when splunk restart. Like it they were encrypted by splunk.
The problem is that the conf file is now different, and the deployment server kick in and redeploy.

My other problem is that I cannot copy my passwd file between servers, the cannot read them.

Sounds pretty lame, is there a way to avoid it ?

1 Solution

yannK
Splunk Employee
Splunk Employee

All is because of the splunk.secret file.

  • At first start, splunk creates a file $SPLUNK_HOME/etc/auth/splunk.secret if this file is not already present.
  • Every password in splunk configurations that are in clear are encrypted at launch. (ssl certificates password in web.conf, ldap passwords in authentication.conf, user password in $SPLUNK_HOME/etc/passwd )

To unify the encryption of the passwords, and avoid redeployments in loop (with version control, or deployment server), please copy the same splunk.secret on each instance before the first start. When generating configurations files, restart splunk to encrypt them, then deploy the encrypted configuration file.

View solution in original post

yannK
Splunk Employee
Splunk Employee

All is because of the splunk.secret file.

  • At first start, splunk creates a file $SPLUNK_HOME/etc/auth/splunk.secret if this file is not already present.
  • Every password in splunk configurations that are in clear are encrypted at launch. (ssl certificates password in web.conf, ldap passwords in authentication.conf, user password in $SPLUNK_HOME/etc/passwd )

To unify the encryption of the passwords, and avoid redeployments in loop (with version control, or deployment server), please copy the same splunk.secret on each instance before the first start. When generating configurations files, restart splunk to encrypt them, then deploy the encrypted configuration file.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...