Archive

Why is the CLI secret parameter called pass4SymmKey in the configuration files?

Ultra Champion

As I prepare for the 24 lab exam, I see these different naming for the CLI secret parameter versus the pass4SymmKey in the configuration files. Why is it?

Tags (2)
0 Karma
1 Solution

Builder

I’ll give it a go to explain; The splunk.secret is the encryption key used by Splunk for most passwords that you enter into most configuration files. When Splunk detects a plaintext password, it will encrypt the password using the splunk.secret key. You can tell that a password has been encrypted when the password string begins with “$1$”—this value is used by Splunk to determine if the password has been encrypted.

When you specify pass4SymmKey in clear-text for an app directory on a Splunk instance (for example: etc/apps/myapp/default/server.conf), the software writes an obfuscated version of the key to the local file (in this example, system/local/server.conf) when you restart the instance. This is done with splunk.secret....

View solution in original post

0 Karma

Builder

I’ll give it a go to explain; The splunk.secret is the encryption key used by Splunk for most passwords that you enter into most configuration files. When Splunk detects a plaintext password, it will encrypt the password using the splunk.secret key. You can tell that a password has been encrypted when the password string begins with “$1$”—this value is used by Splunk to determine if the password has been encrypted.

When you specify pass4SymmKey in clear-text for an app directory on a Splunk instance (for example: etc/apps/myapp/default/server.conf), the software writes an obfuscated version of the key to the local file (in this example, system/local/server.conf) when you restart the instance. This is done with splunk.secret....

View solution in original post

0 Karma

Ultra Champion

It makes sense @Azeemering - much appreciated.

0 Karma

Ultra Champion

Any ideas about this one, by any chance?

0 Karma