topic Re: Why is our Windows Splunk forwarder displaying passwords in clear text in the password file? How do we encrypt it? in Getting Data In

Why is our Windows Splunk forwarder displaying passwords in clear text in the password file? How do we encrypt it?

regba123 — Wed, 17 Aug 2016 19:38:03 GMT

On the Windows side, the Splunk forwarder file displays clear text passwords. Can they be encrypted, and how?

Thanks

Re: Why is our Windows Splunk forwarder displaying passwords in clear text in the password file? How do we encrypt it?

mckeon — Fri, 23 Jun 2017 18:27:01 GMT

Same is happening for me. *nix forwarders are encrypting the sslPassword properly, but Windows forwarders are putting the hashed password somewhere else and leaving the initial configuration sslPassword in clear-text.

Re: Why is our Windows Splunk forwarder displaying passwords in clear text in the password file? How do we encrypt it?

koshyk — Sat, 24 Jun 2017 09:36:53 GMT

I feel It is a bug in Splunk. We have raised numerous cases with Splunk but in vain as the only recommendation they say is to put the password into "etc/system/local" !! We tried putting encrypted password directly into the app, but it didn't work.

If you analyse carefully, the password would have been encrypted and stored in another app's stanza. If you run btool on the client you would see the "stanza" in another app. So the solution is
- take the line of sslPassword out of the app and paste into $SPLUNK_HOME/etc/system/local/.conf
- Find the app which contains the sslPassword stanza which is encrypted. Move the sslPassword stanza to that app

I know, both of them are not perfect solutions.. but we couldn't find any other options.