- Splunk Answers
- :
- Splunk Administration
- :
- Security
- :
- Why is the CLI secret parameter called pass4SymmKe...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
As I prepare for the 24 lab exam, I see these different naming for the CLI secret parameter versus the pass4SymmKey in the configuration files. Why is it?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I’ll give it a go to explain; The splunk.secret is the encryption key used by Splunk for most passwords that you enter into most configuration files. When Splunk detects a plaintext password, it will encrypt the password using the splunk.secret key. You can tell that a password has been encrypted when the password string begins with “$1$”—this value is used by Splunk to determine if the password has been encrypted.
When you specify pass4SymmKey in clear-text for an app directory on a Splunk instance (for example: etc/apps/myapp/default/server.conf), the software writes an obfuscated version of the key to the local file (in this example, system/local/server.conf) when you restart the instance. This is done with splunk.secret....
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I’ll give it a go to explain; The splunk.secret is the encryption key used by Splunk for most passwords that you enter into most configuration files. When Splunk detects a plaintext password, it will encrypt the password using the splunk.secret key. You can tell that a password has been encrypted when the password string begins with “$1$”—this value is used by Splunk to determine if the password has been encrypted.
When you specify pass4SymmKey in clear-text for an app directory on a Splunk instance (for example: etc/apps/myapp/default/server.conf), the software writes an obfuscated version of the key to the local file (in this example, system/local/server.conf) when you restart the instance. This is done with splunk.secret....
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It makes sense @Azeemering - much appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Any ideas about this one, by any chance?
Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!
They're back! Join the SplunkTrust and MVP at .conf24
Enterprise Security Content Update (ESCU) | New Releases
