topic Synchronizing the passwd file between Splunk servers with a shared splunk.secret in Security

Synchronizing the passwd file between Splunk servers with a shared splunk.secret

dflodstrom — Tue, 10 Jan 2017 16:26:02 GMT

My goal is to update the Splunk admin password across newly configured instances using the same password. These servers all have the same splunk.secret, so I figured I could share the $SPLUNK_HOME/etc/passwd file after updating it on one instance.

Before sharing the passwd file, I changed the admin password on a couple of instances and noticed that the hashed value in passwd isn't consistent. Is this the expected behavior?

Re: Synchronizing the passwd file between Splunk servers with a shared splunk.secret

dflodstrom — Tue, 10 Jan 2017 16:38:17 GMT

I've copied the contents of passwd to another instance and successfully logged in with the new password. It seems that splunk generates different hashes but is somehow able to decipher them.

I'd like someone else to confirm this behavior before I select my own answer

Re: Synchronizing the passwd file between Splunk servers with a shared splunk.secret

dflodstrom — Wed, 11 Jan 2017 16:44:53 GMT

I've tested this on several different instances. I can copy the contents of $SPLUNK_HOME/etc/passwd to any other instance that shares a splunk.secret. If the instances are left to create the passwd file by themselves they will create a different hash value representing the same password that can be use on other hosts with a shared splunk.secret. Hopefully someone else finds this useful. Please comment if you've seen other behavior.

Re: Synchronizing the passwd file between Splunk servers with a shared splunk.secret

ridwanahmed — Fri, 27 Jul 2018 18:55:41 GMT

Yes, it is the expected behavior for the hashed values of the same password to be different-- this is because there is a "salt" added when the password is passed through the hashing algorithm . (This makes it more difficult to reverse-engineer passwords from hashed results).

Re: Synchronizing the passwd file between Splunk servers with a shared splunk.secret

xpac — Tue, 04 Dec 2018 14:06:45 GMT

I know this is an old question, but was the first Google result so I thought I'd give it an update.

Sharing the passwd file works without a shared splunk.secret.

Let's take an example line from a passwd file:
:admin:$6$sG0AOkrCThdXQjTF$5Aiq4/slyL4ve0eKrP/iIUP3kE15S2aJOBWrn1YXZzp3o8eqs1luBK8XBBX93ZHg1y6X.Bs5NqTDB98OqSX6Z1::Administrator:admin:changeme@example.com:::32683

The $6$ at the beginning indicates a SHA512 hash.
A so-called salt is saved between the $6$ and the next $ - in this case sG0AOkrCThdXQjTF. It is selected randomly and different each time the password is set/changed. Read more about why salts are used here: Salt@Wikipedia
The final string after the $ is the actual password hash. Even if you set the same password every time, it will be different each time, because a new salt will be randomly chosen and added to the password before it's hashed. In this case, the hash is 5Aiq4/slyL4ve0eKrP/iIUP3kE15S2aJOBWrn1YXZzp3o8eqs1luBK8XBBX93ZHg1y6X.Bs5NqTDB98OqSX6Z1.

However, when a user tries to login, Splunk takes the salt stored in the passwd file instead of selecting a random one, adds the salt to the password the user entered, and runs that string through the SHA512 function. If the result of that operation matches the string after the $, it's considered the right password.

That is the reason that the same password results in different strings on different instances, but you can just copy them over.
Again - no shared splunk.secret required.

Hope that helps @dflodstrom!

Re: Synchronizing the passwd file between Splunk servers with a shared splunk.secret

kotp — Wed, 27 Nov 2024 11:43:15 GMT

It is not related with the splunk.secret as suggested in other replies.

When creating the same users with same passwords in two different instances, it first generates a random salt. Then the salt is concatenated with the password and hashed. It is done this way to ensure the security (to prevent rainow tables). As the salt is randomly generated, both instances will have a random salt (between $6$ and $) and therefore a different hash (after the last mentioned $).

When copying the passwd line to another instance, we are enforcing this new server to use the same salt and therefore the hash will be the same.

In summary, you can both create a user in both servers or just create it in one of them and copy the passwd file to the other one.

If this is helpful please give me karma 😄