topic Re: admin password reset back to default? bug? in Security

admin password reset back to default? bug?

Michael — Tue, 18 Apr 2017 13:29:32 GMT

I have three indexers in a cluster. We're in the process of taking them offline, in turn, for updates. They are running 6.5.1, we are updating them to 6.5.3.

So, I go to take the first one offline and the admin password does not work. On a whim, I tried the default "changeme" and it worked! The last time we did an update it went from 6.5.0 to 6.5.1. Those are the facts, but the assumption is that it got reset when updating to 6.5.1...?

I've been using Splunk for a half-dozen years, and never seen it reset it's admin password back to default...

Thoughts? Bug? Or, just another one of those snowflake things at my site that no one else has ever seen? 😉

Michael

Re: admin password reset back to default? bug?

muebel — Tue, 18 Apr 2017 13:38:05 GMT

Hi Michael,

The admin passwd can get set to default if the etc/passwd file in splunk's installation directory is cleared. Perhaps this is what happened?

Past that, my only readily available explanation is that it was never set to begin with.

If neither of these fit, yeah, file a P4 with support and see if they have any advice.

Please let me know if this answers your question! 😄

Re: admin password reset back to default? bug?

mattymo — Tue, 18 Apr 2017 13:51:27 GMT

How did you do the upgrade? tar? rpm?

Like Muebel said, my guess is etc/passwd got moved or overwritten

Re: admin password reset back to default? bug?

Michael — Tue, 18 Apr 2017 13:54:43 GMT

Ah, that may be it, the sys-admin for the box is using Salt... when check and get back...