Splunk Dev

Storing and retreiving encrypted credentials on Universal Forwarder

andrew207
Path Finder

I need to safely store encrypted credentials on a UF.

I have a scripted input that needs to call an authenticated API endpoint. The authentication is not simple, hence using a scripted input.

I have found that passwords.conf does not work on a UF, as creating the file seems to do nothing and hitting the create endpoint of the UF API returns "Method not allowed" for POST and "Not Implemented" for GET.

Given the UF binary supports the show-decrypted function I should be able to manually encrypt my password and store it that way, but there doesn't seem to be an opposite to show-encrypted to do that. hash-passwd returns a non-reversible hash.

How can I safely store encrypted credentials on a UF within the Splunk ecosystem from an app deployed by a DS?

Labels (2)
Get Updates on the Splunk Community!

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Combine Multiline Logs into a Single Event with SOCK: a Step-by-Step Guide for ...

Combine multiline logs into a single event with SOCK - a step-by-step guide for newbies Olga Malita The ...