Deployment Architecture

What is the best practice to change the Splunk admin password?

mlevsh
Builder

We are running multi cluster Splunk environment with a few indexers, few search heads, heavy forwarder, etc.
We need to change Splunk admin password and we will be doing it via command line on each server.
Is there any potential problems we should be looking for?
What else should we pay attention to prior making the change?

Thank you in advance!

0 Karma
1 Solution

bmacias84
Champion

@mlevsh,

There is away of not hard coding user name and password into a script. Its a technique I've used when building servers with Chef (opsCode). Splunk use two files $SPLUNK_HOME/etc/passwd and $SPLUNK_HOME/etc/auth/splunk.secret to secure local accounts.

  1. On a fresh install of Splunk update the admin password and create any additional local accounts.
  2. Using Chef, SaltStack, Ansible, etc. have the files copied to the new Splunk instance (UF/Enterprise).
  3. Create .ui_login in $SPLUNK_HOME/etc this will prevent the UI to prompt you to change the password.

If you would like to take a look of my chef cookbook it can be found here on github. I originally wrote it for Nordstrom for a 5.x installation. It doesnt quite work since I had to remove any Nordstrom specific, but its a good example.

View solution in original post

0 Karma

bmacias84
Champion

@mlevsh,

There is away of not hard coding user name and password into a script. Its a technique I've used when building servers with Chef (opsCode). Splunk use two files $SPLUNK_HOME/etc/passwd and $SPLUNK_HOME/etc/auth/splunk.secret to secure local accounts.

  1. On a fresh install of Splunk update the admin password and create any additional local accounts.
  2. Using Chef, SaltStack, Ansible, etc. have the files copied to the new Splunk instance (UF/Enterprise).
  3. Create .ui_login in $SPLUNK_HOME/etc this will prevent the UI to prompt you to change the password.

If you would like to take a look of my chef cookbook it can be found here on github. I originally wrote it for Nordstrom for a 5.x installation. It doesnt quite work since I had to remove any Nordstrom specific, but its a good example.

0 Karma

mlevsh
Builder

@somesoni2, I really hope we don't have any scripts with hard-coded passwords. Thank you for your reply!

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Are you using any script where the admin password might be hard-coded? Other than that I think you should be good.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...