topic Re: How to retrieve password from password.conf in python script? in Splunk Dev

How to retrieve password from password.conf in python script?

splunker2117 — Mon, 10 Oct 2022 14:08:29 GMT

Please help in reading the credentials from password.conf in python script.

Re: how to retrieve password from password.conf in python script

gcusello — Mon, 10 Oct 2022 13:12:20 GMT

if you launch your python script as a Splunk input, you can store password in encrypted mode in Splunk passing them from Splunk.

For more infos see at https://www.splunk.com/en_us/blog/security/storing-encrypted-credentials.html

https://www.splunk.com/en_us/blog/tips-and-tricks/store-encrypted-secrets-in-a-splunk-app.html#:~:text=To%20store%20a%20secret%20in,a%20secret%20from%20the%20passwords.

https://www.splunk.com/en_us/blog/security/storing-encrypted-credentials.html?_ga=2.20827064.164275633.1647202914-2144719424.1634111818&_gac=1.26356303.1648138710.CjwKCAjwrfCRBhAXEiwAnkmKmbCHk9mDoX7lbkAx6nO-uQZ16zPzb_egLcEQpg3wmh8PmVk5vBFYAxoCZNUQAvD_BwE&_gl=1*ekcpst*_ga*MjE0NDcxOTQyNC4xNjM0MTExODE4*_gid*MTY0Mjc1NjMzLjE2NDcyMDI5MTQ.*_gac*Q2p3S0NBandyZkNSQmhBWEVpd0Fua21LbWJDSGs5bURvWDdsYmtBeDZuTy11UVoxNnpQemJfZWdMY0VRcGczd21oOFBtVms1dkJGWUF4b0NaTlVRQXZEX0J3RS4xNjQ4MTM4NzEw

This is to create a setup pdashboard in your App to insert pasword:

https://www.splunk.com/en_us/blog/tips-and-tricks/enable-first-run-app-configuration-with-setup-pages.html#:~:text=A%20setup%20page%20is%20a,the%20Splunk%20Web%20user%20interface.

Ciao.

Giuseppe

Re: How to retrieve password from password.conf in python script?

tcole_splunk — Tue, 11 Oct 2022 17:11:07 GMT

Hello!

Just to add to what Giuseppe posted, you can retrieve credentials from passwords.conf using the storage/passwords REST API endpoint and the Splunk SDK for Python. Here is the documentation explaining how to do this:

https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/secretstorage/secretstoragepython

Good luck!

Re: How to retrieve password from password.conf in python script?

splunker2117 — Tue, 11 Oct 2022 18:51:16 GMT

Here I do not want to expose admin credentials even. Is there any way to read password.conf without passing admin credentials. Basically I need to retrieve secrets while running custom command.

Re: How to retrieve password from password.conf in python script?

tcole_splunk — Tue, 11 Oct 2022 19:01:46 GMT

I'm not sure I understand. You need to pass in credentials in order to read passwords.conf, because this file is encrypted and you need to ensure secure access. In order to call the storage/passwords endpoint, the user needs to belong to a role with certain capabilities assigned. See https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/secretstorage/secretstoragerbac for more details.

Re: How to retrieve password from password.conf in python script?

splunker2117 — Wed, 12 Oct 2022 11:10:23 GMT

Let me give you bit background @tcole_splunk @gcusello ,

I've script to run as custom command and secrets are stored in password.conf with the help of setuppage.

Now I am stuck where unable to read the secrets from password.conf to authenticate 3rd party API.

I've used multiple ways to read password.conf however it is failing to connect at initial stage where it call to splunk rest api to retrieve passwords.conf details. Goal is to get the session key without passing the hardcoded values so can use.

service = client.Service(token=session_key,host="127.0.0.1", port=8089)

Re: How to retrieve password from password.conf in python script?

tcole_splunk — Wed, 12 Oct 2022 21:02:17 GMT

Thanks for the additional information. Did you try connecting to Splunk Enterprise with the Python SDK through the connect function? See https://dev.splunk.com/enterprise/docs/devtools/python/sdk-python/howtousesplunkpython/howtoconnectpython.

After that, you should be able to retrieve passwords following the example at https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/secretstorage/secretstoragepython/#Examples.