Security

I would like to copy my authentication.conf and LDAP.conf from one server to another.

hammon0u
Explorer

I would like to copy my authentication.conf and LDAP.conf and openldap certs diretory from one server to the other but the hashed password in the authentication.conf are unreadable except from the server that created them. Creating an authenticaiton.conf file from the UI for every instance is time consuming and does not allow for deployment authmation. Is there a SEED or certificate files that I need to move with them so the hashes will be usable in the authentication.conf file from one server to the other?

Tags (2)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

You can do a couple of things:

  • Just replace the hashed values with the plaintext password and copy that file over. The next time the Splunk instance starts, it will re-hash the password.

OR

  • Copy the file, and also copy the $SPLUNK_HOME/etc/auth/splunk.secret file, and copy and edit the $SPLUNK_HOME/etc/system/local/server.conf and the $SPLUNK_HOME/etc/passwd files, as these files contain hashes that depend on splunk.secret, and will be invalid with a new splunk.secret. Note that the usual server.conf file has a server specific host name in it, but you could replace that with the line serverName = $HOSTNAME to use the environment variable rather than having it hard-coded.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

You can do a couple of things:

  • Just replace the hashed values with the plaintext password and copy that file over. The next time the Splunk instance starts, it will re-hash the password.

OR

  • Copy the file, and also copy the $SPLUNK_HOME/etc/auth/splunk.secret file, and copy and edit the $SPLUNK_HOME/etc/system/local/server.conf and the $SPLUNK_HOME/etc/passwd files, as these files contain hashes that depend on splunk.secret, and will be invalid with a new splunk.secret. Note that the usual server.conf file has a server specific host name in it, but you could replace that with the line serverName = $HOSTNAME to use the environment variable rather than having it hard-coded.

msudhindra
Path Finder

Is there any chance that the splunk.secret and the passwd files can be pushed out from the deployment server ?

We have all our indexers reporting into a central deployment server, and just the ability to push out all these files would help immensely.

0 Karma
Get Updates on the Splunk Community!

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Want a chance to win $500 to the Splunk shop? Take our IT Incident Management Survey!

  Top Trends & Best Practices in Incident ManagementSplunk is partnering up with Constellation Research to ...