Security
Highlighted

How are passwords encrypted in Splunk?

Path Finder

What method is used to protect and encrypt passwords in Splunk. For example the "Users" passwords (when Local type of accounts are used).

Is there a way for a root user of the Splunk server to reverse the passwords to plain text?

0 Karma
Highlighted

Re: How are passwords encrypted in Splunk?

Legend

There is no way for the root user to reverse the passwords. However, someone with access to $SPLUNK_HOME/etc/passwd could edit the file with a text editor, removing users altogether. If all users are removed (usually by renaming the passwd file) then the default Splunk login becomes whatever was specified in user-seed.conf. This is usually user: admin and password: changeme.

I believe that the actual encryption is based on the Unix crypt(3) routine, which is a one-way hash function based upon a modified DES algorithm. But I could be wrong...

View solution in original post

Highlighted

Re: How are passwords encrypted in Splunk?

Splunk Employee
Splunk Employee

You can see the information on the algorithms used in etc/passwd in etc/system/README/authentication.conf.spec and etc/system/default/authentication.conf

At the time of this answer, (5.0.x), Splunk was using MD5 with a large number of rounds. Currently we are using SHA512.