Deployment Architecture

encrypt my password in the configuration across servers with puppet/deployment server

mataharry
Communicator

I have multiple indexers, and a deployment server.
When I deploy my custom configuration files, if they contain a passwords in clear, they are modified when splunk restart. Like it they were encrypted by splunk.
The problem is that the conf file is now different, and the deployment server kick in and redeploy.

My other problem is that I cannot copy my passwd file between servers, the cannot read them.

Sounds pretty lame, is there a way to avoid it ?

1 Solution

yannK
Splunk Employee
Splunk Employee

All is because of the splunk.secret file.

  • At first start, splunk creates a file $SPLUNK_HOME/etc/auth/splunk.secret if this file is not already present.
  • Every password in splunk configurations that are in clear are encrypted at launch. (ssl certificates password in web.conf, ldap passwords in authentication.conf, user password in $SPLUNK_HOME/etc/passwd )

To unify the encryption of the passwords, and avoid redeployments in loop (with version control, or deployment server), please copy the same splunk.secret on each instance before the first start. When generating configurations files, restart splunk to encrypt them, then deploy the encrypted configuration file.

View solution in original post

yannK
Splunk Employee
Splunk Employee

All is because of the splunk.secret file.

  • At first start, splunk creates a file $SPLUNK_HOME/etc/auth/splunk.secret if this file is not already present.
  • Every password in splunk configurations that are in clear are encrypted at launch. (ssl certificates password in web.conf, ldap passwords in authentication.conf, user password in $SPLUNK_HOME/etc/passwd )

To unify the encryption of the passwords, and avoid redeployments in loop (with version control, or deployment server), please copy the same splunk.secret on each instance before the first start. When generating configurations files, restart splunk to encrypt them, then deploy the encrypted configuration file.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...