topic Re: How to delete password of inputs.conf from a modular input? in Getting Data In

How to delete password of inputs.conf from a modular input?

ivan5593 — Wed, 15 Feb 2023 20:53:20 GMT

Hello,

I have created a modular input using the example of splunk-app-example. It extends the class Script and I modified the get_scheme function adding arguments

(example) key_secret = Argument("key_secret") key_secret.title = "Key Secret" key_secret.data_type = Argument.data_type_string key_secret.required_on_create = True

This code allows to save key_secret as a plain string, which is clearly unsecure. Investigating I reached to the storage_password endpoints, and I added the following to stream_events method:

if key_secret != "":

secrets = self.service.storage_passwords

storage_passwords = self.service.storage_passwords

storage_password = storage_passwords.create(key_secret, key_id, tenant) input_item.update({"key_secret": ""})

else:

key_secret = next(secret for secret in secrets if (secret.realm == tenant and secret.username == key_id)).clear_password

This is not working, as I cannot modify the input definition, is storing both in storage_passwords and in inputs.conf. Is there any way in code to delete the inputs.conf password, or what is the correct way to manage this?

Thanks!

Re: How to delete password of inputs.conf from a modular input?

gcusello — Thu, 16 Feb 2023 08:05:24 GMT

Hi @ivan5593,

see these link to store an encrypted password in Splunk:

https://www.splunk.com/en_us/blog/tips-and-tricks/store-encrypted-secrets-in-a-splunk-app.html#:~:text=To%20store%20a%20secret%20in,a%20secret%20from%20the%20passwords.

https://www.splunk.com/en_us/blog/security/storing-encrypted-credentials.html?_ga=2.20827064.164275633.1647202914-2144719424.1634111818&_gac=1.26356303.1648138710.CjwKCAjwrfCRBhAXEiwAnkmKmbCHk9mDoX7lbkAx6nO-uQZ16zPzb_egLcEQpg3wmh8PmVk5vBFYAxoCZNUQAvD_BwE&_gl=1*ekcpst*_ga*MjE0NDcxOTQyNC4xNjM0MTExODE4*_gid*MTY0Mjc1NjMzLjE2NDcyMDI5MTQ.*_gac*Q2p3S0NBandyZkNSQmhBWEVpd0Fua21LbWJDSGs5bURvWDdsYmtBeDZuTy11UVoxNnpQemJfZWdMY0VRcGczd21oOFBtVms1dkJGWUF4b0NaTlVRQXZEX0J3RS4xNjQ4MTM4NzEw

Ciao.

Giuseppe

Re: How to delete password of inputs.conf from a modular input?

ivan5593 — Sun, 19 Feb 2023 19:56:57 GMT

I saw this posts and I adapted the solutions provided using the templates on splunk-app-examples repository. I have now working the modular input and I can create the password as shown before but my issue is more with deleting the plain inputs.conf password and use only the cyphered password on the storage passwords container.

Re: How to delete password of inputs.conf from a modular input?

gcusello — Mon, 20 Feb 2023 06:47:21 GMT

Hi @ivan5593,

if you call the moduls input by Splunk, the password is automatically encrypted, so you can delete (if present) another input.

Ciao.

Giuseppe