topic Re: DB Connect App Encryption in Security

What password encryption scheme does DB Connect App uses for encrypting database passwords?

rsimmons — Fri, 10 Jun 2022 14:49:49 GMT

What password encryption scheme does DB Connect App uses for encrypting database passwords?

Re: DB Connect App Encryption

rsimmons — Tue, 27 Aug 2013 12:12:02 GMT

You can use AES encryption with a secret key derived from the splunk.secret file (which is unique per Splunk instance). At initial startup, Splunk creates the file $SPLUNK_HOME/etc/auth/splunk.secret. This file contains a key used to encrypt some of your authentication information.

To manually change on the command line, see example below. It requires the java bridge to be running.

$ splunk cmd python $SPLUNK_HOME/etc/apps/dbx/bin/jbridge_client.py com.splunk.config.crypt.Crypt encrypt thisIsMyPassword123

Re: DB Connect App Encryption

frankfowler — Tue, 21 Feb 2017 22:29:56 GMT

that is for version 1 of dbConnect - what about version 2 ?

Re: DB Connect App Encryption

gschmitz — Tue, 28 Feb 2017 13:51:00 GMT

I just wondered as well how you would decrypt Dbx2 passwords. Maybe you can update your answer?

Re: DB Connect App Encryption

datasearchninja — Fri, 11 May 2018 00:14:21 GMT

For dbx v2/v3:

 $ echo 'password' | base64 --decode | openssl aes-256-cbc -d -pass file:$SPLUNK_HOME/etc/apps/splunk_app_db_connect/certs/identity.dat

Re: DB Connect App Encryption

aleoliva — Fri, 27 Jul 2018 11:21:44 GMT

Previous command is for decrypting but question was about encrypting.

Encrypting:
$ echo 'thisIsMyPassword' | openssl enc -aes-256-cbc -base64 -pass file:///$SPLUNK_HOME/etc/apps/splunk_app_db_connect/certs/identity.dat -e
Decrypting:
$ echo 'thisIsMyEncryptedPassword' | openssl enc -aes-256-cbc -base64 -pass file:///$SPLUNK_HOME/etc/apps/splunk_app_db_connect/certs/identity.dat -d

Re: DB Connect App Encryption

HansWurscht — Wed, 30 Sep 2020 04:45:49 GMT

When using long passwords, you may have to use -A with openssl.
So for us it was:

Encrypting:

$ echo -n 'thisIsMyPassword' | openssl enc -aes-256-cbc -base64 -pass file:///$SPLUNK_HOME/etc/apps/splunk_app_db_connect/certs/identity.dat -e -A
Decrypting:

$ echo -n 'thisIsMyEncryptedPassword' | openssl enc -aes-256-cbc -base64 -pass file:///$SPLUNK_HOME/etc/apps/splunk_app_db_connect/certs/identity.dat -d

Re: DB Connect App Encryption

appidi_123 — Fri, 10 Jun 2022 14:45:53 GMT

Hello Hans,

I tried the below as suggested to decrypt the password, but i am getting errors are Invalid password argument and Error getting password, i am confused with -pass file argument, i am passing it as -pass /opt/splunk/etc/auth/splunk.secret, please suggest

$ echo -n 'thisIsMyEncryptedPassword' | openssl enc -aes-256-cbc -base64 -pass file:///$SPLUNK_HOME/etc/apps/splunk_app_db_connect/certs/identity.dat -d

Re: DB Connect App Encryption

nadcohen — Mon, 13 Jun 2022 08:59:22 GMT

Hello the ser reading this,

if you get "bad decrypt"

try

echo 'U2FsdGVkX1/8/PnefMMBHA8f/IavzfMuBDyTjjNlZtg=' | base64 --decode | /opt/splunk/bin/splunk cmd openssl aes-256-cbc -d -pass file:/opt/splunk/etc/apps/splunk_app_db_connect/certs/identity.dat

the version of the openssl should be the one Splunk uses, otherwise you might get "bad decrypt"

Re: DB Connect App Encryption

WurschtHans — Wed, 31 Jan 2024 15:42:27 GMT

Thank YOU!!!

That worked after hours of searching!