topic How to encrypt password in app outputs.conf? in Getting Data In

How to encrypt password in app outputs.conf?

karlbosanquet — Wed, 28 Oct 2015 13:35:07 GMT

I am deploying Indexer Cluster settings in an app to multiple Universal Forwarders via the Deployment Server. The issue I have is that they require the Indexer Cluster password to be sent in the /local/outputs.conf file.

App deployment works fine and a new outputs.conf is created on the Universal Forwarder under $SPLUNK_HOME/etc/system/local with the required stanza and encrypted password.

The issue is that the password exists in clear text in 2 places;

Deployment Server - $SPLUNK_HOME/etc/deployment_apps/app_name/local/outputs.conf

Universal Forwarder - $SPLUNK_HOME/etc/apps/app_name/local/outputs.conf

Is there a way for the password to be encrypted at all locations?

Re: How to encrypt password in app outputs.conf?

Richfez — Tue, 07 Feb 2017 00:26:30 GMT

This problem seems to be known. Read this section on the docs and it mentions this specifically. It also gives a sort of workaround, too:

Warning: If you configure inputs.conf or outputs.conf in an app directory, the password is NOT encrypted and the clear-text value remains in the file. For this reason, you may prefer to create different certificates (signed by the same root CA) to use when configuring SSL in app directories.

By adding this answer the question will pop up to the top of the stack, so maybe someone else will have a better answer.

Re: How to encrypt password in app outputs.conf?

karlbosanquet — Tue, 07 Feb 2017 21:01:49 GMT

My current solution is a script which pushes the pass4SymmKey password out to Universal Forwarders, then I deploy an empty app from the Deployment Server called 'restart' with the restart services flag checked which restarts the UF service on all of the UFs, which hashes the password.