Audit Default Admin Creds?

[muebel]

Something that should be done for hardening a default installation of Splunk is changing the default admin password. In fact, this is suggested on the login page if the password is still set to the default.

Does anybody know if the status of the admin password is retrievable through internal/audit logging, or the rest interface? Splunk seems to know about itself in this way, and I'd like to audit for it.

One way is a simple script that attempt to auth against the instance using the default creds, but it would be cleaner to leverage existing logging.

[DMohn]

You can check the internal _audit index for password changes of the admin user:

 index=_audit user=admin action=password*

This will show you all events where a password change has been issued for the admin user. Even the initial pw change during first login will be captuerd.

Still, this will not tell you if the password was reset to the initial one, but it gives you an idea, if any changes have been made at all!

[lukejadamec]

You can create an input to monitor the passwd file. It will allow you to track all changes to passwords and differentiate by host. It will not tell you exactly what the password is because it is encrypted, but if the input is included as part of the install then it will show you if the admin password was changed.

inputs.conf

[monitor://$SPUNK_HOME\etc\passwd]
disabled = false
sourcetype = passwd

[muebel]

Thanks for the answer, but I'm looking for something out-of-the-box to a greater degree. Additionally, indexing passwd doesn't seem ideal.

[msmith4]

Like you mentioned, using REST api to authenticate with default pass using Wget or curl would be the easiest test case. And also most reliable one.

[muebel]

I'm really interested in an out of the box search that will turn up the admin password status of some particular splunk instance, leveraging any of the internal-type indexes (internal, audit, introspection) or otherwise something through REST.

It seems that Splunk has this data available to itself at least, and uses it to warn users at the login page, but from reading the documentation, I'm not finding this available otherwise.