Security

Any tool to encrypt passwords based on a splunk.secret?

Super Champion

We have multiple secrets for the different tiers (forwarders/search heads etc.). Some of the apps like IPS needs to have UI to encrypt password 😞 which is not possible on all tiers.

Is there a tool/API which can encrypt the password based on splunk.secret ?

eg. what I'm looking for is

=> supply passwords.conf and splunk.secret as inputs to the tool
=> run the api/tool so that it takes passwords.conf and splunk.secret of the relevant tier/server and hash the password with it

Thanks in advance

1 Solution

SplunkTrust
SplunkTrust

You could spin up a splunk instance with the splunk secret. Then use the encrypted password endpoint via your own script to enter passwords then grab the results from passwords.conf.

http://www.georgestarcher.com/splunk-stored-encrypted-credentials/

View solution in original post

SplunkTrust
SplunkTrust

There's an even easier available now, a Python project called splunksecrets that can be installed via PIP and gives you an easy CLI to encrypt + decrypt new and old secrets:

https://pypi.org/project/splunksecrets/

SplunkTrust
SplunkTrust

You could spin up a splunk instance with the splunk secret. Then use the encrypted password endpoint via your own script to enter passwords then grab the results from passwords.conf.

http://www.georgestarcher.com/splunk-stored-encrypted-credentials/

View solution in original post

Super Champion

I had seen the website, but great to see the answer from the person itself. 🙂 You guys are real heroes.

We had similar issues and great if we can work on a github project to make this automated for ansible
Accepting the answer.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!