topic Re: Is there a Splunk account lockout for users if you enter your password multiple times? in Security

Is there a Splunk account lockout for users if you enter your password multiple times?

inventsekar — Wed, 12 Sep 2018 04:41:34 GMT

Hi
As all my splunk projects are using LDAP for login, this issue never occurred to me.
1. if we configure splunk's local authentication system and create users, and when the users type wrong password for multiple times, will their account get locked out?
2. For all kinds of users (normal, power, admin) users as well?
3. with any login systems(splunk's own authentication/LDAP/etc), does splunk records the users login/logouts/lockouts, password failures?

EDIT:
This task applies to Splunk Enterprise native authentication and does not apply to SAML or LDAP passwords.
In Splunk Web, click Settings > Access Controls > Password Policy Management.

Re: Is there a Splunk account lockout for users if you enter your password multiple times?

renjith_nair — Wed, 12 Sep 2018 06:48:40 GMT

@inventsekar ,

From 7.1.0 ,
1. you can configure the lock out period and number of failed attempts. Refer List of password policy configurations
2. For the "admin" privileged users, it doesn't seem to lock the account
3. For the authentication failures, it should be recorded in "_audit" logs for e.g. action="login attempt"

Re: Is there a Splunk account lockout for users if you enter your password multiple times?

inventsekar — Wed, 12 Sep 2018 12:35:56 GMT

we are on Splunk 7x, but still no results for ...
index="_audit" action=*login*

Re: Is there a Splunk account lockout for users if you enter your password multiple times?

renjith_nair — Thu, 13 Sep 2018 05:39:15 GMT

One of the envs which is running on 6.6.2 with LDAP authentication has the following entry which confirms the logging of external authentication system.

Audit:[timestamp=09-13-2018 06:17:23.690, user=xxxxxx, action=login attempt, info=succeeded, src=0.0.0.0][n/a]

Which auth mechanism are you using?

Re: Is there a Splunk account lockout for users if you enter your password multiple times?

inventsekar — Tue, 29 Sep 2020 21:16:35 GMT

we are using some scripted authentication...
After doing some tweekings, i am able to find the info required..

eventtype=splunk_access
index=_* info=succeeded
index=_audit info=succeeded
index=_audit eventtype=splunk_access

will do some more searching and once i am clear of all doubts, i will accept this as answer..

Re: Is there a Splunk account lockout for users if you enter your password multiple times?

jhomerlopez — Mon, 01 Oct 2018 06:58:52 GMT

Even admin and other privileged users can have a lock out policy. There is a capability inside roles management named "never_lockout". You just have to removed it under the "admin" default role.

Re: Is there a Splunk account lockout for users if you enter your password multiple times?

kmjefferson42 — Tue, 09 Sep 2025 15:14:51 GMT

Thank you for this information!! I greatly appreciate it, Ken