Security

How to change credentials stored in passwords.conf?

savithamr
Path Finder

Hi,

Firstly, I created a setup.xml following the link: http://docs.splunk.com/Documentation/Splunk/6.4.1/AdvancedDev/SetupExampleCredentials

I am able to save credentials through setup.xml to apps local/passwords.conf file..

[credential:10.11.0.221:admin:]
password = $1$EncryptionPwd

Now, the issue is how to change the admin password if the entered password is wrong or it expires after a certain number of days. Customer is not happy with the solution of deleting that particular entry from passwords.conf file and adding again.

I got to know there is method setEntity to change password like getEntity (retrieves credentials).. but not getting how exactly to use that through setup.xml.
Pls help..

AMAN0113
Explorer

Is there a way to do this already? Stuck at the exact same point.

0 Karma

nit123
Path Finder

Hi Savitha & Alex,

I went through your comments .

It is recommended to store passwords in your splunk app as encrypted. Splunk provides a REST endpoint for securely storing credentials. More information is here: http://blogs.splunk.com/2011/03/15/storing-encrypted-credentials/

a. Follow the steps and secure your app in the Splunk way. It could also get decrypted password from Splunk using getEntities and appropriate calls.
b. Once you save the credentials from the setup page of your app, you will find an encrypted password in passwords.conf file .
c. Please refer to this link for code samples http://www.georgestarcher.com/splunk-stored-encrypted-credentials/

If my answer solve your question, spare a moment to accept the answer and vote for it . Thanks.

0 Karma

alexbourla
New Member

In some work I'm doing at the moment I've hit exactly the same stumbling block - would like to use the app-setup to set credentials as explained in the docs but want to be able to ensure I can update them within the UI. Seems quite a big limitation! Did you find any alternative?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...