Knowledge Management

Smartstore configuration : How to encrypt volume definitions and use bundle deployment?

emallinger
Communicator

Hello,
I would like to have confirmation of the best secure way to create smartstore volume (with access keys) : how will bundle validation behave if :?
- I declare volumes (with access_keys) in /opt/splunk/etc/apps/myvolumes/local/indexes.conf ON each indexers
- I push the indexes definitions (with those volumes) in /opt/splunk/etc/master-apps/myindexes/local/indexes.conf from the Cluster Master

Protocol would be : maintenance mode, stop every indexers, deploy new conf files via git (and finalize manually for the volume keys not to appear in git), validate bundle on the CM

=> Will it even work as there is no volume definition on the CM in /opt/splunk/etc/master-apps/myindexes/local/indexes.conf ?

There is something I do not understand : How am I supposed to secure (encrypt ?) the access keys in the cluster AND use the CM for bundle deployment ?

Thank you,

Ema

Labels (1)
Tags (3)
0 Karma

emallinger
Communicator

Yeah, that I did already : and the access-key transmitted in the bundle are still clear and not encrypted on the Cluster Master AND on all the indexers.

It's not very satisfactory to keep it that way.

Hence me asking for suggestions.

Ema

0 Karma

emallinger
Communicator

Hi again,

Is your sandbox clustered with a cluster master ?

Thanks,

Ema

0 Karma

richgalloway
SplunkTrust
SplunkTrust

My sandbox is not clustered, but that should not affect how the keys are stored.

You don't have to put all indexes in SmartStore so test it out with an index you create for that purpose.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Unlike pass4SymmKey, S3 access and secret keys are not stored in encrypted form.  That means you can deploy they keys from the CM without concern for how they will be saved on the indexers.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

emallinger
Communicator

Hello,

Seriously ?

Wow, that's weird...

Ema

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, I was serious, because the documentation says nothing about access keys being encrypted (unlike pass4SymmKey).

I took a look at one of my sandboxes, however, and see that remote.s3.access_key and remote.s3.secret_key are both encrypted.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...