topic Re: Why is the indexer discovery clear text password not being encrypted? in Getting Data In

Why is the indexer discovery clear text password not being encrypted?

Lucas_K — Thu, 12 Nov 2015 00:10:06 GMT

I've enabled indexer discovery on my 6.3.1 linux universal forwarders.

http://docs.splunk.com/Documentation/Splunk/6.3.1/Indexer/indexerdiscovery

3. Configure the forwarders
a. Configure the forwarders to use indexer discovery

On each forwarder, add these settings to the outputs.conf file:

[indexer_discovery:<name>]
pass4SymmKey = <string>
master_uri = <uri>

[tcpout:<target_group>]
indexerDiscovery = <name>

I have noticed that the pass4SymmKey is not being encrypted when the server first starts after its been added.

Is this by design or is it a flaw?

Re: Why is the indexer discovery clear text password not being encrypted?

Lowell — Tue, 15 Dec 2015 22:55:33 GMT

On at test I'm running, it looks like the encrypted version is stored under $SPLUNK_HOME/etc/system/local/outputs.conf instead of under the apps folder where the base setting is located. This seems even more problematic as system/local doesn't get updated.

Re: Why is the indexer discovery clear text password not being encrypted?

s2_splunk — Tue, 15 Dec 2015 23:06:21 GMT

Take a look here, specifically the section that states: Warning: If you configure inputs.conf or outputs.conf in an app directory, the password is NOT encrypted and the clear-text value remains in the file. For this reason, you may prefer to create different certificates (signed by the same root CA) to use when configuring SSL in app directories.

Re: Why is the indexer discovery clear text password not being encrypted?

Lowell — Tue, 15 Dec 2015 23:25:04 GMT

Well this talks about SSL passwords, not pass4SymmKey under [indexer_discovery:], but I suppose the same logic could apply. I'm a bit confused by this behavior. I understand why there are issues if you stick a password in a "default" directory, but I'm not sure what the issue is with updating entries in the "local" folder.

Re: Why is the indexer discovery clear text password not being encrypted?

Lowell — Tue, 15 Dec 2015 23:33:37 GMT

Even stranger, I'm staring at a Splunk 6.1 outputs.conf that has an encrypted sslPassword in $SPLUNK_HOME/etc/apps/MY_Forwarder_Outputs/local/outputs.conf. So I'm going to disagree with the docs on this point.

Re: Why is the indexer discovery clear text password not being encrypted?

Intermediate — Wed, 21 Mar 2018 06:52:24 GMT

Does this section address your question?
https://docs.splunk.com/Documentation/Splunk/7.0.2/Security/Aboutsecuringclusters#How_pass4SymmKey_gets_encrypted_in_apps

It states:

When you specify pass4SymmKey in clear-text for an app directory in a
Splunk instance (for example: etc/apps/myapp/default/server.conf),
an obfuscated version is written to the local file (in this example,
system/local/server.conf) upon restart. Usually configuration files
in the default directory are read only, and the information is also
written to the local file, which is editable.

A password placed directly into an app's local directory (for example:
etc/apps/myapp/local/server.conf), will be replaced with the encrypted
version.

When the configuration is listed using curl or a splunkd endpoint, the
pass4SymmKey appears encrypted. If the configuration location is read-only,
Splunk software likewise writes to local.