Security

Unhash password found on Slave-apps

jaracan
Communicator

Hi Team,

We had an app for called "org_full_license_server_ssl" and it contains a server.conf
This server.conf has a parameter called "sslPassword".

Let say, the sslPassword is abcd1234 on this example.

So we had deploy the "org_full_license_server_ssl" using the CM's master-apps, and it was push to the Peer nodes/IDX slave-apps.
We notice that the server.conf's parameter value for sslPassword is a readable "abcd1234". Do we have insights why it did not got hash on the first place?

Or is the best practice to move the "org_full_license_server_ssl" from etc/slave-apps to etc/apps?
I am thinking, it might be the splunk.secret did not take effect if its on the etc/slave-apps

Any thoughts/insights?

Thanks

0 Karma
1 Solution

dkeck
Influencer

HI,

its normal that passwords do not get hashed in slave-apps or deplyomentapps.

View solution in original post

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

have you try to put those passwords under local not to default directory? At least some times this has fixed it.

r. Ismo

0 Karma

dkeck
Influencer

HI,

its normal that passwords do not get hashed in slave-apps or deplyomentapps.

0 Karma

jaracan
Communicator

Hi dkeck,

so the best practice to move the "org_full_license_server_ssl" from etc/slave-apps to etc/apps and then restart it so it will be hash, correct?

0 Karma

dkeck
Influencer

Have to be configured on each peer in etc/apps to be hashed yes.

0 Karma

weicai88
Path Finder

I am having the same issue. Probably you can get the hash value on the CM, assuming it has the same certificate and splunk secret (which is used to encrypt the password), and plug the hash in the master app, then deploy the bundle to peers.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...