Deployment Architecture

encrypt my password in the configuration across servers with puppet/deployment server

mataharry
Communicator

I have multiple indexers, and a deployment server.
When I deploy my custom configuration files, if they contain a passwords in clear, they are modified when splunk restart. Like it they were encrypted by splunk.
The problem is that the conf file is now different, and the deployment server kick in and redeploy.

My other problem is that I cannot copy my passwd file between servers, the cannot read them.

Sounds pretty lame, is there a way to avoid it ?

1 Solution

yannK
Splunk Employee
Splunk Employee

All is because of the splunk.secret file.

  • At first start, splunk creates a file $SPLUNK_HOME/etc/auth/splunk.secret if this file is not already present.
  • Every password in splunk configurations that are in clear are encrypted at launch. (ssl certificates password in web.conf, ldap passwords in authentication.conf, user password in $SPLUNK_HOME/etc/passwd )

To unify the encryption of the passwords, and avoid redeployments in loop (with version control, or deployment server), please copy the same splunk.secret on each instance before the first start. When generating configurations files, restart splunk to encrypt them, then deploy the encrypted configuration file.

View solution in original post

yannK
Splunk Employee
Splunk Employee

All is because of the splunk.secret file.

  • At first start, splunk creates a file $SPLUNK_HOME/etc/auth/splunk.secret if this file is not already present.
  • Every password in splunk configurations that are in clear are encrypted at launch. (ssl certificates password in web.conf, ldap passwords in authentication.conf, user password in $SPLUNK_HOME/etc/passwd )

To unify the encryption of the passwords, and avoid redeployments in loop (with version control, or deployment server), please copy the same splunk.secret on each instance before the first start. When generating configurations files, restart splunk to encrypt them, then deploy the encrypted configuration file.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...