Security

Any tool to encrypt passwords based on a splunk.secret?

koshyk
Super Champion

We have multiple secrets for the different tiers (forwarders/search heads etc.). Some of the apps like IPS needs to have UI to encrypt password 😞 which is not possible on all tiers.

Is there a tool/API which can encrypt the password based on splunk.secret ?

eg. what I'm looking for is

=> supply passwords.conf and splunk.secret as inputs to the tool
=> run the api/tool so that it takes passwords.conf and splunk.secret of the relevant tier/server and hash the password with it

Thanks in advance

1 Solution

starcher
SplunkTrust
SplunkTrust

You could spin up a splunk instance with the splunk secret. Then use the encrypted password endpoint via your own script to enter passwords then grab the results from passwords.conf.

http://www.georgestarcher.com/splunk-stored-encrypted-credentials/

View solution in original post

xpac
SplunkTrust
SplunkTrust

There's an even easier available now, a Python project called splunksecrets that can be installed via PIP and gives you an easy CLI to encrypt + decrypt new and old secrets:

https://pypi.org/project/splunksecrets/

starcher
SplunkTrust
SplunkTrust

You could spin up a splunk instance with the splunk secret. Then use the encrypted password endpoint via your own script to enter passwords then grab the results from passwords.conf.

http://www.georgestarcher.com/splunk-stored-encrypted-credentials/

koshyk
Super Champion

I had seen the website, but great to see the answer from the person itself. 🙂 You guys are real heroes.

We had similar issues and great if we can work on a github project to make this automated for ansible
Accepting the answer.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...