topic Re: Why is the SDEE script showing my user/pass? in Security

Why is the SDEE script showing my user/pass?

XenoPhage — Wed, 16 Mar 2011 03:13:20 GMT

I think it's ironic to see a security plugin doing something insecurely.. Anyway, here's a rough hack to fix this. Instead of showing the username and password in both the manager->data inputs->scripts section as well as the processlist on the server itself, this reads the username and password from a text file.

Note : This is a hack and not meant to be a final solution. I'm not sure how to modify the setup scripts yet, but it would be much nicer if the final solution were to generate these password files on the fly or give the user the option to use password files or put the data directly in the CLI command.

# Place this code at the bottom of the get_ips_feed.py.
# Comment out the last run() command in that file (it should be the last line)
# and append the following :

#run(sys.argv[1],sys.argv[2],sys.argv[3],"https","yes")

passwd_conf = '/opt/splunk/etc/apps/Splunk_CiscoIPS/local/.ids_passwd'
username = ""
password = ""

try:
        f = open(passwd_conf, 'r')
        user_passwd_arr = f.readline().strip().split(':')
        f.close()
        if (len(user_passwd_arr) != 2):
                sys.exit("The file "+ passwd_conf +" has the wrong syntax")
        else:
                username = user_passwd_arr[0]
                password = user_passwd_arr[1]
except OSError:
        sys.exit("The file "+ passwd_conf +" could not be opened")

run(username,password,sys.argv[3],"https","yes")

Re: Why is the SDEE script showing my user/pass?

southeringtonp — Wed, 16 Mar 2011 04:08:05 GMT

Great suggestion and proof of concept. One nitpick though - personally, I'd lean against credentials in a hidden file. Security by obscurity and all that.

Re: Why is the SDEE script showing my user/pass?

dart — Thu, 17 Mar 2011 21:35:29 GMT

There is an endpoint in 4.2 for storing credentials, which the SDEE app will likely be updated to use.

See this other question

Re: Why is the SDEE script showing my user/pass?

jhansen — Tue, 22 Mar 2011 10:37:35 GMT

The current published release is intended to provide backward compatibility with Splunk 4.1.x, which doesn't include the new endpoint. The next maintenance release of the app should include this. Keep an eye out.

Re: Why is the SDEE script showing my user/pass?

XenoPhage — Wed, 23 Mar 2011 02:08:51 GMT

Agreed, however I'm not sure there was an alternative pre splunk 4.2. I'm not familiar with the endpoint in 4.2 yet, so I'm looking forward to seeing how this will work.