https://community.splunk.com/t5/Security/Splunk-Enterprise-Login/m-p/327606#M12481 <P>Did you rename the right passwd file? Is Splunk installed somewhere else?</P> <P>If you delete or rename the splunk_home/etc/passwd file and restart, it makes the admin password changeme everytime.</P> <P>The only explanation is if you didn't rename the right file or some symbolic link exists.</P> Sat, 22 Jul 2017 23:58:11 GMT jkat54 2017-07-22T23:58:11Z https://community.splunk.com/t5/Security/Splunk-Enterprise-Login/m-p/327603#M12478 <P>Hello all,</P> <P>I am having problems logging into Enterprise. I've tried my username and password, admin and changeme after moving the opt/splunk/etc/ passwd file and renaming it. Still won't work. If there's any better way to reset to allow login, i'd appreciate it. It was working just fine yesterday. </P> <P>Thank You </P> Sat, 22 Jul 2017 22:34:05 GMT https://community.splunk.com/t5/Security/Splunk-Enterprise-Login/m-p/327603#M12478 dannyze 2017-07-22T22:34:05Z https://community.splunk.com/t5/Security/Splunk-Enterprise-Login/m-p/327604#M12479 <P>Google says - <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/3252iD4972D81A6678322/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>Did you restart splunk?</P> Sat, 22 Jul 2017 22:40:51 GMT https://community.splunk.com/t5/Security/Splunk-Enterprise-Login/m-p/327604#M12479 ddrillic 2017-07-22T22:40:51Z https://community.splunk.com/t5/Security/Splunk-Enterprise-Login/m-p/327605#M12480 <P>I did do ./splunk restart. No luck.</P> Sat, 22 Jul 2017 22:49:41 GMT https://community.splunk.com/t5/Security/Splunk-Enterprise-Login/m-p/327605#M12480 dannyze 2017-07-22T22:49:41Z https://community.splunk.com/t5/Security/Splunk-Enterprise-Login/m-p/327606#M12481 <P>Did you rename the right passwd file? Is Splunk installed somewhere else?</P> <P>If you delete or rename the splunk_home/etc/passwd file and restart, it makes the admin password changeme everytime.</P> <P>The only explanation is if you didn't rename the right file or some symbolic link exists.</P> Sat, 22 Jul 2017 23:58:11 GMT https://community.splunk.com/t5/Security/Splunk-Enterprise-Login/m-p/327606#M12481 jkat54 2017-07-22T23:58:11Z https://community.splunk.com/t5/Security/Splunk-Enterprise-Login/m-p/327607#M12482 <P>jkat54 <BR /> I believe I renamed the right file. Renamed passwd to passwd.back, a new file was then generated passwd. Did the restart and it won't allow me access. What could the symbolic link be you mentioned?</P> Sun, 23 Jul 2017 00:07:32 GMT https://community.splunk.com/t5/Security/Splunk-Enterprise-Login/m-p/327607#M12482 dannyze 2017-07-23T00:07:32Z https://community.splunk.com/t5/Security/Splunk-Enterprise-Login/m-p/327608#M12483 <P>Do you have another authentication method configured, such as SSO or SAML? If these are enabled, you need to disable them for the local passwords to be used.</P> Sun, 23 Jul 2017 00:48:19 GMT https://community.splunk.com/t5/Security/Splunk-Enterprise-Login/m-p/327608#M12483 esix_splunk 2017-07-23T00:48:19Z https://community.splunk.com/t5/Security/Splunk-Enterprise-Login/m-p/327609#M12484 <P>@esix is right. Do you have local authentication disabled?</P> <P>/Applications/splunk/bin/splunk btool authentication list --debug</P> Sun, 23 Jul 2017 12:59:38 GMT https://community.splunk.com/t5/Security/Splunk-Enterprise-Login/m-p/327609#M12484 jkat54 2017-07-23T12:59:38Z https://community.splunk.com/t5/Security/Splunk-Enterprise-Login/m-p/327610#M12485 <P>So once I get to the btool file in the bin, what would I need to do?</P> Sun, 23 Jul 2017 20:18:30 GMT https://community.splunk.com/t5/Security/Splunk-Enterprise-Login/m-p/327610#M12485 dannyze 2017-07-23T20:18:30Z https://community.splunk.com/t5/Security/Splunk-Enterprise-Login/m-p/327611#M12486 <P>That whole line is a command you can run to show what type of authentication you have setup. Post the outputp</P> Sun, 23 Jul 2017 20:29:22 GMT https://community.splunk.com/t5/Security/Splunk-Enterprise-Login/m-p/327611#M12486 jkat54 2017-07-23T20:29:22Z https://community.splunk.com/t5/Security/Splunk-Enterprise-Login/m-p/327612#M12487 <P>Thank you, this was the output<BR /> authType = Splunk<BR /> passwordHashAlgorithm = SHA512-crypt<BR /> [cacheTiming]<BR /> getUserInfoTTL = 10s<BR /> getUsersTTL = 10s<BR /> userLoginTTL = 0<BR /> [secrets]<BR /> filename = <BR /> namespace = splunk</P> Sun, 23 Jul 2017 20:34:37 GMT https://community.splunk.com/t5/Security/Splunk-Enterprise-Login/m-p/327612#M12487 dannyze 2017-07-23T20:34:37Z