Security

Cluster Deployer applying bundle caching credentials too long - credentials seem to be cached indefinitely

pkeller
Contributor

On one of my non-production search deployers, when I issue an apply shcluster-bundle, I am not being challenged for username/password after the first successful authentication following a splunk restart.

I've compared the server.conf->shclustering between two deployers, one that seems to challenge me pretty much ever time (preferred) and this other one that never challenges me ... the shclustering configs are identical.

Can anyone point me to where this can be configured? I do wish to be challenged routinely because we typically perform these operations across a team of Splunk admins using their own credentials. The current situation implies that Splunk is seemingly caching the credentials indefinitely.

note: I realize I can use -auth username:password ... but obviously, the cleartext password then gets written into the shell history which I do not want.

0 Karma
1 Solution

bheemireddi
Communicator

Hi Pkeller,

When you run those any admin commands, for any other purpose you inputted the admin credentials on performing other commands on that VM/server, the same credentials it tries to use for the following commands. For example if you have the Deployment server/Deployer on the same VM/server, you ran reload deploy-server and inputed the credentials, and you ran apply shcluster-bundle followed by reload, it doesn't ask you for the credentials and may be this is what is happening.

View solution in original post

0 Karma

bheemireddi
Communicator

Hi Pkeller,

When you run those any admin commands, for any other purpose you inputted the admin credentials on performing other commands on that VM/server, the same credentials it tries to use for the following commands. For example if you have the Deployment server/Deployer on the same VM/server, you ran reload deploy-server and inputed the credentials, and you ran apply shcluster-bundle followed by reload, it doesn't ask you for the credentials and may be this is what is happening.

0 Karma

pkeller
Contributor

My question is more around the challenging of those credentials. Our preference would be that we are challenged for credentials every time. And from your comments, it appears that it's not available. Thanks for replying. 🙂

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...