Deployment Architecture

encrypt my password in the configuration across servers with puppet/deployment server

mataharry
Communicator

I have multiple indexers, and a deployment server.
When I deploy my custom configuration files, if they contain a passwords in clear, they are modified when splunk restart. Like it they were encrypted by splunk.
The problem is that the conf file is now different, and the deployment server kick in and redeploy.

My other problem is that I cannot copy my passwd file between servers, the cannot read them.

Sounds pretty lame, is there a way to avoid it ?

1 Solution

yannK
Splunk Employee
Splunk Employee

All is because of the splunk.secret file.

  • At first start, splunk creates a file $SPLUNK_HOME/etc/auth/splunk.secret if this file is not already present.
  • Every password in splunk configurations that are in clear are encrypted at launch. (ssl certificates password in web.conf, ldap passwords in authentication.conf, user password in $SPLUNK_HOME/etc/passwd )

To unify the encryption of the passwords, and avoid redeployments in loop (with version control, or deployment server), please copy the same splunk.secret on each instance before the first start. When generating configurations files, restart splunk to encrypt them, then deploy the encrypted configuration file.

View solution in original post

yannK
Splunk Employee
Splunk Employee

All is because of the splunk.secret file.

  • At first start, splunk creates a file $SPLUNK_HOME/etc/auth/splunk.secret if this file is not already present.
  • Every password in splunk configurations that are in clear are encrypted at launch. (ssl certificates password in web.conf, ldap passwords in authentication.conf, user password in $SPLUNK_HOME/etc/passwd )

To unify the encryption of the passwords, and avoid redeployments in loop (with version control, or deployment server), please copy the same splunk.secret on each instance before the first start. When generating configurations files, restart splunk to encrypt them, then deploy the encrypted configuration file.

View solution in original post

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!