topic Re: Does Splunk auto update the etc/password file? in Splunk Enterprise

Does Splunk auto update the etc/password file?

human96 — Tue, 22 Mar 2022 05:45:30 GMT

Hi, Splunkers,

I have a doubt. now currently using Splunk enterprise 8.2.5, today morning the etc/password file auto-updated and detected by a third party software ( confidential ).

I never changed the file, so my question is-- does Splunk auto-update the $SPLUNK_HOME/etc/password file?

please provide any Splunk documentation

Re: Does Splunk auto update the etc/password file?

VatsalJagani — Tue, 22 Mar 2022 05:36:39 GMT

* If you mean passwd file of Linux system (/etc/passwd) - No Splunk does not touch any file outside its the home directory.

* If you mean passwd file of Splunk ($SPLUNK_HOME/etc/passwd) - Splunk stores user information there so if you have done any modification regarding user or role or user-password on Splunk then Splunk might have updated the file.

Re: Does Splunk auto update the etc/password file?

human96 — Tue, 22 Mar 2022 05:42:21 GMT

Thanks for the quick response

yes i meant $SPLUNK_HOME/etc/passwd

but recently i did not change any user information, roles, password.

but still the file automatically updated itself.

Re: Does Splunk auto update the etc/password file?

VatsalJagani — Tue, 22 Mar 2022 06:16:34 GMT

Can you please explain why Splunk updating its own file is a problem?

Re: Does Splunk auto update the etc/password file?

human96 — Tue, 22 Mar 2022 07:11:10 GMT

no, i'm not saying it's a problem. i just want to know.

does splunk very often update the password file ?

Re: Does Splunk auto update the etc/password file?

VatsalJagani — Tue, 22 Mar 2022 13:03:50 GMT

I know User changes (password, name, roles update) could trigger the file to update but not without any reason.

* Check with Splunk support if you think it is happening regularly and without any reason.

* Though I personally have not seen such a bug with any version of Splunk.