topic Re: Splunk's $SPLUNK_HOME/etc/passwd File syntax and encryption/hashing algorithm in Security

Splunk's $SPLUNK_HOME/etc/passwd File syntax and encryption/hashing algorithm

Ricapar — Tue, 02 Jul 2013 17:23:12 GMT

I've searched around a good bit.. haven't found any official documentation on the topic.

On Splunk forwarders and indexers, Splunk stores users and their info in $SPLUNK_HOME/etc/passwd

Cat-ing the file on one of my forwarders looks like this:

:admin:<hashed-password>::Administrator:admin:changeme@example.com:

My two questions are:

What is the full syntax for the passwd file? Some fields are obvious, but I still haven't found any offical docs on the syntax.
How is the hashed password generated? Is it actually a hash, or a reversible encryption? In either case, what algorithm is used and how is it seeded?

Ayn — Tue, 02 Jul 2013 20:35:15 GMT

nikhil1231 — Tue, 11 Jul 2023 20:38:34 GMT

Hi i forgot my password, i need help in resetting it. many thanks