Getting Data In

Why is the indexer discovery clear text password not being encrypted?

Lucas_K
Motivator

I've enabled indexer discovery on my 6.3.1 linux universal forwarders.

http://docs.splunk.com/Documentation/Splunk/6.3.1/Indexer/indexerdiscovery

3. Configure the forwarders
a. Configure the forwarders to use indexer discovery

On each forwarder, add these settings to the outputs.conf file:

[indexer_discovery:<name>]
pass4SymmKey = <string>
master_uri = <uri>

[tcpout:<target_group>]
indexerDiscovery = <name>

I have noticed that the pass4SymmKey is not being encrypted when the server first starts after its been added.

Is this by design or is it a flaw?

s2_splunk
Splunk Employee
Splunk Employee

Take a look here, specifically the section that states: Warning: If you configure inputs.conf or outputs.conf in an app directory, the password is NOT encrypted and the clear-text value remains in the file. For this reason, you may prefer to create different certificates (signed by the same root CA) to use when configuring SSL in app directories.

Lowell
Super Champion

Well this talks about SSL passwords, not pass4SymmKey under [indexer_discovery:], but I suppose the same logic could apply. I'm a bit confused by this behavior. I understand why there are issues if you stick a password in a "default" directory, but I'm not sure what the issue is with updating entries in the "local" folder.

Intermediate
Path Finder

Does this section address your question?
https://docs.splunk.com/Documentation/Splunk/7.0.2/Security/Aboutsecuringclusters#How_pass4SymmKey_g...

It states:

When you specify pass4SymmKey in clear-text for an app directory in a
Splunk instance (for example: etc/apps/myapp/default/server.conf),
an obfuscated version is written to the local file (in this example,
system/local/server.conf) upon restart. Usually configuration files
in the default directory are read only, and the information is also
written to the local file, which is editable.

A password placed directly into an app's local directory (for example:
etc/apps/myapp/local/server.conf), will be replaced with the encrypted
version.

When the configuration is listed using curl or a splunkd endpoint, the
pass4SymmKey appears encrypted. If the configuration location is read-only,
Splunk software likewise writes to local.

0 Karma

Lowell
Super Champion

Even stranger, I'm staring at a Splunk 6.1 outputs.conf that has an encrypted sslPassword in $SPLUNK_HOME/etc/apps/MY_Forwarder_Outputs/local/outputs.conf. So I'm going to disagree with the docs on this point.

0 Karma

Lowell
Super Champion

On at test I'm running, it looks like the encrypted version is stored under $SPLUNK_HOME/etc/system/local/outputs.conf instead of under the apps folder where the base setting is located. This seems even more problematic as system/local doesn't get updated.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!