topic Re: Admin Passwords Across Clusters in Splunk Search

Admin Passwords Across Clusters

jaxjohnny2000 — Tue, 04 Jun 2019 17:49:46 GMT

Just to be sure, does the admin password need to be the same for each component in the Search Head or Index Cluster?

Re: Admin Passwords Across Clusters

Vijeta — Tue, 04 Jun 2019 19:11:44 GMT

@jaxjohnny - No it does not need to be same. The pass4symmkey for cluster would be one .

Re: Admin Passwords Across Clusters

ddrillic — Tue, 04 Jun 2019 19:52:04 GMT

@jaxjohnny2000, more about pass4symmkey at Secure your clusters with pass4SymmKey

And to be clear it says there -

pass4SymmKey controls authentication between Splunk instances and does not manage user access.

Re: Admin Passwords Across Clusters

DavidHourani — Wed, 05 Jun 2019 04:15:38 GMT

Hi @jaxjohnny2000,

Admin password doesn't have to be the same accross all hosts and I would also say shouldnt be.

Only pass4SymmKeyshould be the same for your cluster config but even that key can be different for different components (SH cluster can use a key that is different from your IDX cluster).

Most clients configure centralized authentication (LDAP based for example) and would use real user credentials while giving the admin user a complex password. This password is then stored somewhere safe and isnt used in day to day configs; only for intial setup.

So to keep it short same admin password everywhere is for lazy people and is not secure, best not share the same one.

Cheers,
David

Re: Admin Passwords Across Clusters

jaxjohnny2000 — Wed, 05 Jun 2019 11:08:54 GMT

Thank you. That was also my assumption, but getting it in answers was my goal.

Re: Admin Passwords Across Clusters

triest — Wed, 04 Sep 2019 17:14:56 GMT

The question was

does the admin password need to be the
same for each component in the Search
Head or Index Cluster

So while the above answer above is semi-correct, it doesn't need to be the same across all hosts from the perspective that forwarder admin passwords can be different from each other and the search heads. The admin passwords across the search heads in any given search head cluster do need to be the same since the cluster will synchronize the passwords of local accounts.