Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Admin Other
- :
- Security
- :
- Is there a Splunk account lockout for users if you...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi
As all my splunk projects are using LDAP for login, this issue never occurred to me.
1. if we configure splunk's local authentication system and create users, and when the users type wrong password for multiple times, will their account get locked out?
2. For all kinds of users (normal, power, admin) users as well?
3. with any login systems(splunk's own authentication/LDAP/etc), does splunk records the users login/logouts/lockouts, password failures?
EDIT:
This task applies to Splunk Enterprise native authentication and does not apply to SAML or LDAP passwords.
In Splunk Web, click Settings > Access Controls > Password Policy Management.
Sekar
PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@inventsekar ,
From 7.1.0 ,
1. you can configure the lock out period and number of failed attempts. Refer List of password policy configurations
2. For the "admin" privileged users, it doesn't seem to lock the account
3. For the authentication failures, it should be recorded in "_audit" logs for e.g. action="login attempt"
What goes around comes around. If it helps, hit it with Karma 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@inventsekar ,
From 7.1.0 ,
1. you can configure the lock out period and number of failed attempts. Refer List of password policy configurations
2. For the "admin" privileged users, it doesn't seem to lock the account
3. For the authentication failures, it should be recorded in "_audit" logs for e.g. action="login attempt"
What goes around comes around. If it helps, hit it with Karma 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Even admin and other privileged users can have a lock out policy. There is a capability inside roles management named "never_lockout". You just have to removed it under the "admin" default role.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
we are on Splunk 7x, but still no results for ...
index="_audit" action=*login*
Sekar
PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
One of the envs which is running on 6.6.2 with LDAP authentication has the following entry which confirms the logging of external authentication system.
Audit:[timestamp=09-13-2018 06:17:23.690, user=xxxxxx, action=login attempt, info=succeeded, src=0.0.0.0][n/a]
Which auth mechanism are you using?
What goes around comes around. If it helps, hit it with Karma 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
we are using some scripted authentication...
After doing some tweekings, i am able to find the info required..
eventtype=splunk_access
index=_* info=succeeded
index=_audit info=succeeded
index=_audit eventtype=splunk_access
will do some more searching and once i am clear of all doubts, i will accept this as answer..
Sekar
PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
What Is Splunk? Here’s What You Can Do with Splunk
Level Up Your .conf25: Splunk Arcade Comes to Boston
Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...
