topic Re: capabilities required for enabling/disabling maintenance mode in Security

What are the capabilities required for enabling/disabling maintenance mode?

splkjk — Wed, 23 Mar 2022 16:22:19 GMT

Hello Team, What capabilities are required for enabling and disabling the maintenance mode. Based on the following link https://community.splunk.com/t5/Security/Capabilities-needed-for-a-service-account-to-enable-Maintenance/m-p/345744 , i did provide the following capability edit_indexer_cluster , but no breakthrough.

Re: capabilities required for enabling/disabling maintenance mode

SanjayReddy — Wed, 23 Mar 2022 16:02:13 GMT

Hi @splkjk

are you trying to enable/disbale maintenace mode from Clustermaster UI?. we dont have option to enable /disable from UI

after adding capability edit_indexer_cluster try to execute follwing commands from CLI

$SPLUNK_HOME$/bin

./splunk show maintenance-mode -auth <splunkusername>:<password>

./splunk enable maintenance-mode <splunkusername>:<password>

./splunk disable maintenance-mode <splunkusername>:<password>

Re: capabilities required for enabling/disabling maintenance mode

splkjk — Wed, 23 Mar 2022 16:58:06 GMT

Hi @SanjayReddy , Thanks for the inputs...

nope, I'm not using GUI for enabling or disabling maintenance mode.

we did add edit_indexer_cluster , but when i try to execute enable maintenance with below error

******:~ $ /opt/splunk/bin/splunk enable maintenance-mode
Warning: In maintenance mode, the cluster manager will not attempt to replace any missing replicated or searchable bucket copies. This mode should be enabled only while performing maintenance on peers. Do you want to continue? [y/n]: y
Your session is invalid. Please login.
Splunk username: testuser
Password:
Login failed
call not properly authenticated

below are the capability added for that role

[role_supp_team]
cumulativeRTSrchJobsQuota = 0
cumulativeSrchJobsQuota = 0
edit_indexer_cluster = enabled
importRoles = user
srchMaxTime = 8640000

Re: capabilities required for enabling/disabling maintenance mode

SanjayReddy — Thu, 24 Mar 2022 04:30:20 GMT

Hi @splkjk

it seems login failed due to there was issue with username/password,

please try to use correct username/password, or reset the creds and try again

I am able to to enable/disable maintenance mode from same configuration you mentioned,

have you added role_supp_team to test user under users settings

Re: capabilities required for enabling/disabling maintenance mode

splkjk — Fri, 25 Mar 2022 12:33:05 GMT

Hi @SanjayReddy , i am able to login to splunk via GUI , by providing the same id and password. But when I try to execute the enable the maintenance mode on Cluster master, it gets failed and i do have the same role that is mentioned in your screenshot.

I am still getting the same error

Your session is invalid. Please login.
Splunk username: testuser
Password:
Login failed
call not properly authenticated

Re: capabilities required for enabling/disabling maintenance mode

splkjk — Fri, 25 Mar 2022 15:03:23 GMT

Hello @SanjayReddy tried crossing 1 hurdle..

so, our environment is a cluster environment with few search heads and few indexers, a Cluster master and Deployer. so i created user on search head and that was the reason i was able to login to splunk GUI, but not able to enable the maintenance mode on CM. so i have created the same role and user on cluster master and tried executing the maintenance mode , it did get executed, but now with different error, i have provided edit_indexer_cluster capability, still getting the error, not sure why...., any insights

Your session is invalid. Please login.
Splunk username: testuser
Password:
You (user=testuser) do not have permission to perform this operation (requires capability: edit_indexer_cluster).