topic Re: Unhash password found on Slave-apps in Security

Unhash password found on Slave-apps

jaracan — Tue, 29 Sep 2020 23:26:39 GMT

Hi Team,

We had an app for called "org_full_license_server_ssl" and it contains a server.conf
This server.conf has a parameter called "sslPassword".

Let say, the sslPassword is abcd1234 on this example.

So we had deploy the "org_full_license_server_ssl" using the CM's master-apps, and it was push to the Peer nodes/IDX slave-apps.
We notice that the server.conf's parameter value for sslPassword is a readable "abcd1234". Do we have insights why it did not got hash on the first place?

Or is the best practice to move the "org_full_license_server_ssl" from etc/slave-apps to etc/apps?
I am thinking, it might be the splunk.secret did not take effect if its on the etc/slave-apps

Any thoughts/insights?

Thanks

Re: Unhash password found on Slave-apps

dkeck — Wed, 27 Feb 2019 08:31:21 GMT

HI,

its normal that passwords do not get hashed in slave-apps or deplyomentapps.

Re: Unhash password found on Slave-apps

jaracan — Tue, 29 Sep 2020 23:26:44 GMT

Hi dkeck,

so the best practice to move the "org_full_license_server_ssl" from etc/slave-apps to etc/apps and then restart it so it will be hash, correct?

Re: Unhash password found on Slave-apps

dkeck — Wed, 27 Feb 2019 09:20:15 GMT

Have to be configured on each peer in etc/apps to be hashed yes.

Re: Unhash password found on Slave-apps

weicai88 — Fri, 12 Jun 2020 14:56:46 GMT

I am having the same issue. Probably you can get the hash value on the CM, assuming it has the same certificate and splunk secret (which is used to encrypt the password), and plug the hash in the master app, then deploy the bundle to peers.

Re: Unhash password found on Slave-apps

isoutamo — Sun, 14 Jun 2020 20:49:05 GMT

have you try to put those passwords under local not to default directory? At least some times this has fixed it.

r. Ismo