topic Re: Setting SSL password in inputs.conf but does not get encrypted after restart in Getting Data In

Setting SSL password in inputs.conf but does not get encrypted after restart

horsefez — Tue, 29 Sep 2020 10:21:06 GMT

Hi fellow splunkers,

I recently noticed a configuration error. I wrongly distributed the "[SSL] password= "via cluster-bundle to the indexers.
The problem as you might know is that the password gets not encrypted when it's on the indexers. And there is an even bigger problem to this, about duplicated apps.

Anyway...
I now tried to correct this fault, by deleting the "password = " entry in the .../etc/master_apps/_cluster/local/ on the master and distributed these settings to the indexer-cluster.
Then I went onto every indexer manually and added the [SSL] Stanza and "password= " entry to the .../etc/system/local/inputs.conf. After that I restarted splunkd on all of them.

Sadly this didn't encrypt the password. What could be wrong?

Thank you for your suggestions!
Best regards,
pyro_wood

Re: Setting SSL password in inputs.conf but does not get encrypted after restart

jkat54 — Fri, 22 Jul 2016 14:25:35 GMT

According to this:
http://docs.splunk.com/Documentation/Splunk/6.2.3/Security/Deploysecurepasswordsacrossmultipleservers

It only encrypts the password in inputs.conf & outputs.conf if its found in a splunktcp-ssl stanza.

Re: Setting SSL password in inputs.conf but does not get encrypted after restart

mckeon — Fri, 23 Jun 2017 18:02:39 GMT

password should be sslPassword, I believe.

Re: Setting SSL password in inputs.conf but does not get encrypted after restart

mattlucas719 — Tue, 23 Apr 2019 17:41:30 GMT

the indexer is encrypting this inside it's /opt/splunk/etc/apps/directory as a copy of the app, it doesn't write it to the bundle directory found in slave-apps