Deployment Architecture

splunk edit user admin clears admin password instead of changing it

wsanderstii
Path Finder

I found this answer about changing the admin password in splunk (I am using splunkforwarder 4.5.2 actually):

https://answers.splunk.com/answers/9465/admin-password-on-command-line.html

After I issue the command " ./splunk edit user admin -password foo -role admin -auth admin:changeme" this seems to actually clear the password instead of resetting it. In other words, even after I log out of the host and log back in, I am no longer prompted for a username and password.

Is this supposed to happen?

It doesn't bother me too much because only root has permission to run the splunk command line tool anyway. And the password change does take effect on the Atom server on port 8089.

w

Tags (1)

wsanderstii
Path Finder

Splunk is not actually clearing the password - the " ./splunk edit user admin -password foo -role admin -auth admin:changeme" is only for use when the password is the default post-install "admin/changeme". When the command is run, the " -auth admin:changeme" parameters authenticate the user, and the authentication is cached for a period of time. At the same time, the command changes the password and updates the $SPLUNK_HOME/etc/passwd file.

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Interesting. so, the authentication is persistent for a period, thus not requiring the new password be entered?

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!