https://community.splunk.com/t5/Security/Is-pass4symmkey-a-critical-security-option-for-indexer/m-p/680252#M17674 <P>Hi all,</P><P>I have seen that pass4symmkey is optional when enabling indexer clustering. Some say that if someone knows this value, they can access the entire cluster, and it is necessary to consider a complex value for it. Would it be possible to clarify if this value should be complex and if it is simple it could cause a security breach or not? If someone knows this value, can it be a threat to the cluster and gain access to the cluster or not?</P><P>Thank you</P> Mon, 11 Mar 2024 08:12:21 GMT sigma 2024-03-11T08:12:21Z https://community.splunk.com/t5/Security/Is-pass4symmkey-a-critical-security-option-for-indexer/m-p/680252#M17674 <P>Hi all,</P><P>I have seen that pass4symmkey is optional when enabling indexer clustering. Some say that if someone knows this value, they can access the entire cluster, and it is necessary to consider a complex value for it. Would it be possible to clarify if this value should be complex and if it is simple it could cause a security breach or not? If someone knows this value, can it be a threat to the cluster and gain access to the cluster or not?</P><P>Thank you</P> Mon, 11 Mar 2024 08:12:21 GMT https://community.splunk.com/t5/Security/Is-pass4symmkey-a-critical-security-option-for-indexer/m-p/680252#M17674 sigma 2024-03-11T08:12:21Z https://community.splunk.com/t5/Security/Is-pass4symmkey-a-critical-security-option-for-indexer/m-p/680265#M17677 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/258974">@sigma</a>&nbsp;the pass4SymKey is a unique key provided by Splunk that enables communication and authentication between your indexers and other relevant instances, such as SHs and CM&lt;&gt;IDX. In summary, pass4Symkey does not regulate user access; rather, it manages authentication between Splunk instances. For additional details, click this link:&nbsp;</P><P><A href="https://docs.splunk.com/Documentation/Splunk/9.2.0/Security/Aboutsecuringclusters" target="_blank" rel="noopener">https://docs.splunk.com/Documentation/Splunk/9.2.0/Security/Aboutsecuringclusters</A>&nbsp;</P><P>If someone gains access to the pass4SymmKey, they could potentially compromise the security of the entire cluster.</P><P>An attacker with knowledge of the pass4SymmKey could impersonate cluster nodes, manipulate data, or disrupt the cluster’s functionality.</P><P>Therefore, treat the pass4SymmKey as a sensitive secret and store it securely.</P> Mon, 11 Mar 2024 10:34:53 GMT https://community.splunk.com/t5/Security/Is-pass4symmkey-a-critical-security-option-for-indexer/m-p/680265#M17677 kiran_panchavat 2024-03-11T10:34:53Z