topic Re: Authentication.conf files in Security

Authentication.conf files

Orange_girl — Thu, 29 Feb 2024 15:21:32 GMT

Hello, I am new to splunk and noticed we have two different authentication.conf files in the local folder. I compared them two and they are the same except for information regarding groupbasedn and the host. Also the bind password doesn’t get hashed after splunk restart in one of the files. Unfortunately I don’t have more information on this and trying to understand what’s the reason for the 2nd file. If the bind password is updated in the 1st file, we are still not able to access splunk which makes me thing the 2nd file is needed for some reason. Would anyone be able to suggest the reasons for the 2nd file? I wonder if I need it. I’m concern with using the 2nd file as well since the password doesn’t get hashed. Thank you for your help!

Re: Authentication.conf files

isoutamo — Thu, 29 Feb 2024 17:48:13 GMT

there couldn’t be two files with same name on local directory!
You should use

splunk btool authentication list --debug

to see how splunk sees those and from which file.

r. Ismo

Re: Authentication.conf files

PickleRick — Thu, 29 Feb 2024 23:41:56 GMT

There is no posibility that you have two identically named files in one directory. Maybe one has a typo in its name, maybe the case of the letters in the name is wrong. We don't know but check again. (Hint - wrong named file won't be used and values in it won't get encrypted on first read).

Re: Authentication.conf files

Orange_girl — Fri, 01 Mar 2024 08:12:23 GMT

I’m sorry, I should’ve been more specific. The files don’t have the same name, one is called authentication.conf and the other one authentication.conf_2. I have updated the binddnpassword in the authentication.conf file, rebooted server, the password got hashed but I’m still not able to log into splunk.

Re: Authentication.conf files

PickleRick — Fri, 01 Mar 2024 08:15:34 GMT

Only the file authentication.conf is used. The other one - with different extension - is not used. (which should be shown in the output of the commanf @isoutamo provided.

Splunk only uses files with the exact name needed, not with some additional prefixes or suffixes (but they can be in various directories from which they are "layered" onto each other according to the precedence rules.

https://docs.splunk.com/Documentation/Splunk/9.2.0/Admin/Wheretofindtheconfigurationfiles

Why your authentication doesn't work though - we don't know. Not enough information. Look in your logs, look in your authentication server (LDAP?) logs. That might shed some light on the reasons.