Using a scripted input's passAuth token for CLI access from the scripted input

[dwaddle]

I am trying to create a scripted input that can run some Splunk CLI commands. Using passAuth in inputs.conf I was able to pass in (and read from stdin) an auth token. But I can't find how to successfully take that token and pass it back in on a CLI command line. I tried -auth <token> and got a "Login failed". Any idea what CLI argument (if any) allows me to authenticate from an auth token directly?

Related question at http://splunk-base.splunk.com/answers/6707/splunk-admin-credentials-in-scripted-input

[JackNobrega]

Here is something simple and similar to the above answer, but is all cli.

Replace localhost with your host ip/hostname
Replace testdude with your username which you must know the password for.
Then run it.

read -s -p "Enter Password: " mypassword;t=curl -k https://localhost:8089/services/auth/login --data-urlencode username=testdude --data-urlencode password=$mypassword;mytoken=echo $t|grep -Po '<.*?>\K.*?(?=<.*?>)'|sed '/^\s$/d';curl -k -H "Authorization: Splunk $mytoken" https://localhost:8089/services/search/jobs/export -d output_mode=csv -d search="search index=_internal |head 10";mypassword="";mytoken="";t=""

Here it is broken down.
read -s -p "Enter Password: " mypassword; allows you to enter password with entering it on command line and stores it in a variable, which is cleaned up at end.
t=curl -k https://localhost:8089/services/auth/login --data-urlencode username=testdude --data-urlencode password=$mypassword; stores tokenized output in variable, which is cleaned up at end.
mytoken=echo $t|grep -Po '<.*?>\K.*?(?=<.*?>)'|sed '/^\s$/d'; uses above variable/output and strips it down to just token and stores it in variable
curl -k -H "Authorization: Splunk $mytoken" https://localhost:8089/services/search/jobs/export -d output_mode=csv -d search="search index=_internal |head 10"; uses token to run search
mypassword="";mytoken="";t="" cleaned up of variables used.

P.S. Please shoot holes/refine it. I think it will make it more useful for everyone.

[Lowell]

While there isn't a CLI command line option, there is an environment variable you can set to pass an authentication token directly to the Splunk CLI. You can use the $SPLUNK_TOK variable for this. There is very little documentation on this, if any, but it allows you to use the CLI directly, without creating an auth token file. Similarly, you can also pass this token in on the Authorization header via a curl command to call arbitrary REST endpoints. Example below:

#!/bin/bash
# Make sure passAuth=user is setup in your scripted input stanza, or this script will hang waiting for input.
read tok

# Do whatever CLI call you want to do
SPLUNK_TOK=$tok $SPLUNK_HOME/bin/splunk list forward-server

# Or make whatever REST call via CURL, like so:
curl -k -H "Authorization: Splunk $tok" https://localhost:8089/servicesNS/-/-/data/inputs/script

# Or restart Splunkd, ....
curl -k -H "Authorization: Splunk $tok" -X POST https://localhost:8089/services/server/control/restart
...

All of southeringtonp's warnings about security still apply. It's possible for other processes to look at another processes env variable (in the case of the Splunk CLI), and to see the command line options (in the case of curl). However, this may be considered "safer" than writing auth tokens to the file system.

One positive security note is that Splunk appears to expire the token after the script completes, so that should reduce the window for any potential abuse of these credentials for quick scripts.

[southeringtonp · Accepted solution]

There isn't a CLI argument to do that. You would likely be better served by going through the REST API if possible.

When you run a splunk CLI search, it will look in ~/.splunk for an existing authToken, and prompts you for credentials if a valid authToken is not found. Typically that file is written when you run splunk login.

There's nothing to prevent you from writing that file out yourself before calling the CLI, but give careful consideration to the implications of doing so. First, any user who could read that directory could use those credentials (which is already true). Second, if you also run CLI commands directly as root (or splunk's service account), either the interactive user or the scripted input could get the wrong credentials.

If you absolutely must call CLI commands directly, there's a workaround. Use mktemp to create a temporary directory, and make sure the permissions are restricted. Write the authToken to $TMPDIR/.splunk/authToken_<hostname>_<portnum>. Then, set the $HOME environment variable to your $TMPDIR before calling the CLI command(s). Once you're done, delete the authToken and the temporary directory.

[dwaddle]

Yup, making your own authToken file works. The caveats still apply, but it got me around my specific issue here.

[anz_leycurav]

Note for Windows users: the USERPROFILE, HOMEDRIVE and HOMEPATH env variables also need to be updated.

this was tested on 6.3.3 so is still relevant as of May 2016.