Getting Data In
Highlighted

Why is our Windows Splunk forwarder displaying passwords in clear text in the password file? How do we encrypt it?

New Member

On the Windows side, the Splunk forwarder file displays clear text passwords. Can they be encrypted, and how?

Thanks

0 Karma
Highlighted

Re: Why is our Windows Splunk forwarder displaying passwords in clear text in the password file? How do we encrypt it?

Explorer

Same is happening for me. *nix forwarders are encrypting the sslPassword properly, but Windows forwarders are putting the hashed password somewhere else and leaving the initial configuration sslPassword in clear-text.

0 Karma
Highlighted

Re: Why is our Windows Splunk forwarder displaying passwords in clear text in the password file? How do we encrypt it?

Super Champion

I feel It is a bug in Splunk. We have raised numerous cases with Splunk but in vain as the only recommendation they say is to put the password into "etc/system/local" !! We tried putting encrypted password directly into the app, but it didn't work.

If you analyse carefully, the password would have been encrypted and stored in another app's stanza. If you run btool on the client you would see the "stanza" in another app. So the solution is
- take the line of sslPassword out of the app and paste into $SPLUNK_HOME/etc/system/local/.conf
- Find the app which contains the sslPassword stanza which is encrypted. Move the sslPassword stanza to that app

I know, both of them are not perfect solutions.. but we couldn't find any other options.

0 Karma