topic Re: Rest access to indexer from search head without password in Security

Rest access to indexer from search head without password

nhalakatti_splu — Mon, 20 May 2019 17:04:36 GMT

I am trying to print the status and the hardware info for my indexers by executing the rest endpoint /services/server/info for each of the indexers on the search head by getting the indexer ip's from /services/search/distributed/peers endpoint. Given that the user has admin credentials and access, we can get the auth token to execute rest calls on search head using auth/login endpoint. Is there a way we can access the indexers from the search head without using the auth/login endpoint which requires indexer credentials input in the rest call. So basically if the username /password are different on indexers compared to the search head I need to keep taking the input credentials for each indexer to get the indexer information on the search head.

Is there a way to accomplish this without asking indexer credentials? or Is there a way as an admin I can get the credentials for accessing the indexers and then I can use the auth/login way?

Note: There is the trusted.pem that contains the public key of SH in SPLUNK_HOME/etc/auth/distServerKeys on the search that is distributed to indexers on adding the peer. But I believe this is more useful in SSH. Not sure if this can be used in a REST call to indexer

Re: Rest access to indexer from search head without password

somesoni2 — Mon, 20 May 2019 18:39:20 GMT

You do this via | rest search command or using curl (or any other rest tool)?

Re: Rest access to indexer from search head without password

nhalakatti_splu — Mon, 20 May 2019 19:33:45 GMT

curl like mechanism

Re: Rest access to indexer from search head without password

harsmarvania57 — Tue, 21 May 2019 08:09:44 GMT

Yes you can achieve this but it will still require you to fetch Session Key for each Indexer first on SH. When you hit /services/search/distributed/peers REST endpoint on SH, you will get list of all Indexers and for each Indexer there is remote_session which is Session Key.

So you can use that remote_session in curl as given below

curl -k -H "Authorization: Splunk INDEXER_REMOTE_SESSION_KEY" https://<indexer_host_ip>:8089/services/server/info

Re: Rest access to indexer from search head without password

nhalakatti_splu — Tue, 21 May 2019 20:14:09 GMT

Thanks @harsmarvania57 ! This does the trick!