topic Disable local user login bypass in Security

Disable local user login bypass

riyastk — Fri, 07 Feb 2020 11:03:27 GMT

Hi,

I have enabled SSO authentication for my splunk instance. However, I am still able to login as local user with en-US/account/login?loginType=splunk option. Is there an option to disable this bypassing to tighten security?

Re: Disable local user login bypass

nickhills — Fri, 07 Feb 2020 11:25:32 GMT

You can not disable local authentication, but you can prevent it from working.
Bear in mind that you can luse dap from the cli, but not SAML.

To "break" local authentication remove $SPLUNK_HOME/etc/passwd This will remove any local user passwords.
Restart Splunk, when prompted set a username and password for admin
Edit $SPLUNK_HOME/etc/passwd and replace random characters in the hash password field (making the old password unusable)
Restart Splunk - your admin password will no longer work.

Note any OS user with appropriate perms can perform steps 1-2 to regain access

Re: Disable local user login bypass

riyastk — Fri, 07 Feb 2020 13:58:23 GMT

Is there anyway we can turn the login page blank or something ?

Re: Disable local user login bypass

nickhills — Fri, 07 Feb 2020 14:02:52 GMT

no. I dont belive so.