How to delete password of inputs.conf from a modular input?

[ivan5593]

Hello,

I have created a modular input using the example of splunk-app-example. It extends the class Script and I modified the get_scheme function adding arguments

(example) key_secret = Argument("key_secret") key_secret.title = "Key Secret" key_secret.data_type = Argument.data_type_string key_secret.required_on_create = True  

This code allows to save key_secret as a plain string, which is clearly unsecure. Investigating I reached to the storage_password endpoints, and I added the following to stream_events method:

if key_secret != "":

secrets = self.service.storage_passwords

storage_passwords = self.service.storage_passwords

storage_password = storage_passwords.create(key_secret, key_id, tenant) input_item.update({"key_secret": ""})

else:

key_secret = next(secret for secret in secrets if (secret.realm == tenant and secret.username == key_id)).clear_password

This is not working, as I cannot modify the input definition, is storing both in storage_passwords and in inputs.conf. Is there any way in code to delete the inputs.conf password, or what is the correct way to manage this?

Thanks!

[gcusello]

Hi @ivan5593,

see these link to store an encrypted password in Splunk:

https://www.splunk.com/en_us/blog/tips-and-tricks/store-encrypted-secrets-in-a-splunk-app.html#:~:te....

https://www.splunk.com/en_us/blog/security/storing-encrypted-credentials.html?_ga=2.20827064.1642756...

Ciao.

Giuseppe

[ivan5593]

I saw this posts and I adapted the solutions provided using the templates on splunk-app-examples repository. I have now working the modular input and I can create the password as shown before but my issue is more with deleting the plain inputs.conf password and use only the cyphered password on the storage passwords container.

[gcusello]

Hi @ivan5593,

if you call the moduls input by Splunk, the password is automatically encrypted, so you can delete (if present) another input.

Ciao.

Giuseppe