encrypt my password in the configuration across servers with puppet/deployment server

[mataharry]

I have multiple indexers, and a deployment server.
When I deploy my custom configuration files, if they contain a passwords in clear, they are modified when splunk restart. Like it they were encrypted by splunk.
The problem is that the conf file is now different, and the deployment server kick in and redeploy.

My other problem is that I cannot copy my passwd file between servers, the cannot read them.

Sounds pretty lame, is there a way to avoid it ?

[yannK · Accepted solution]

All is because of the splunk.secret file.

• At first start, splunk creates a file $SPLUNK_HOME/etc/auth/splunk.secret if this file is not already present.
• Every password in splunk configurations that are in clear are encrypted at launch. (ssl certificates password in web.conf, ldap passwords in authentication.conf, user password in $SPLUNK_HOME/etc/passwd )

To unify the encryption of the passwords, and avoid redeployments in loop (with version control, or deployment server), please copy the same splunk.secret on each instance before the first start. When generating configurations files, restart splunk to encrypt them, then deploy the encrypted configuration file.