Getting Data In

Why is the indexer discovery clear text password not being encrypted?

Motivator

I've enabled indexer discovery on my 6.3.1 linux universal forwarders.

http://docs.splunk.com/Documentation/Splunk/6.3.1/Indexer/indexerdiscovery

3. Configure the forwarders
a. Configure the forwarders to use indexer discovery

On each forwarder, add these settings to the outputs.conf file:

[indexer_discovery:<name>]
pass4SymmKey = <string>
master_uri = <uri>

[tcpout:<target_group>]
indexerDiscovery = <name>

I have noticed that the pass4SymmKey is not being encrypted when the server first starts after its been added.

Is this by design or is it a flaw?

Splunk Employee
Splunk Employee

Take a look here, specifically the section that states: Warning: If you configure inputs.conf or outputs.conf in an app directory, the password is NOT encrypted and the clear-text value remains in the file. For this reason, you may prefer to create different certificates (signed by the same root CA) to use when configuring SSL in app directories.

Super Champion

Well this talks about SSL passwords, not pass4SymmKey under [indexer_discovery:], but I suppose the same logic could apply. I'm a bit confused by this behavior. I understand why there are issues if you stick a password in a "default" directory, but I'm not sure what the issue is with updating entries in the "local" folder.

Path Finder

Does this section address your question?
https://docs.splunk.com/Documentation/Splunk/7.0.2/Security/Aboutsecuringclusters#How_pass4SymmKey_g...

It states:

When you specify pass4SymmKey in clear-text for an app directory in a
Splunk instance (for example: etc/apps/myapp/default/server.conf),
an obfuscated version is written to the local file (in this example,
system/local/server.conf) upon restart. Usually configuration files
in the default directory are read only, and the information is also
written to the local file, which is editable.

A password placed directly into an app's local directory (for example:
etc/apps/myapp/local/server.conf), will be replaced with the encrypted
version.

When the configuration is listed using curl or a splunkd endpoint, the
pass4SymmKey appears encrypted. If the configuration location is read-only,
Splunk software likewise writes to local.

0 Karma

Super Champion

Even stranger, I'm staring at a Splunk 6.1 outputs.conf that has an encrypted sslPassword in $SPLUNK_HOME/etc/apps/MY_Forwarder_Outputs/local/outputs.conf. So I'm going to disagree with the docs on this point.

0 Karma

Super Champion

On at test I'm running, it looks like the encrypted version is stored under $SPLUNK_HOME/etc/system/local/outputs.conf instead of under the apps folder where the base setting is located. This seems even more problematic as system/local doesn't get updated.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!