Is there a way to use splunk.secret on the server to encrypt all files that look like sslPasswords?

[chris94089]

So the Deployment Sever's job is to hold a bunch of apps, some of which contain outputs.conf to send to Deployment Clients

Outputs.conf has a field called sslPassword.  When placed in the deployment app library, this value is written in plain text right now.

Am I doing this wrong?  Is this how it's supposed to work?  Anybody who shells into the container can see a plain text password right there in $SPLUNK_HOME/etc/deployment-apps/myapp/local/outputs.conf!

When the app reaches the Deployment Client, the password becomes encrypted when the app is installed.  That's not the issue.  The issue is I don't want them in plain text on my server.  I don't want them in plain text anywhere.

Is there a better way to manage these sslPasswords? (the ones that live in the deployment-apps, not used to configure the server itself) on the Deployment Server though?  I really hope I'm doing this wrong.

For example, is there a way to use splunk.secret on the Server to encrypt ALL files that look like sslPasswords? Is there a feature request in the works?  Am I the first person to ever ask for this?

[thambisetty]

First of all, you are not doing it wrong. That's by design. Passwords are encrypted using splunk.secret. splunk.secret would be different in Deployment server and deployment client. if sslPassword is kept enrypted in Deployment server then UF can't decrypt it when the app is deployed. 

See below:

https://docs.splunk.com/Documentation/Splunk/8.0.5/Security/ConfigureSplunkforwardingtousesignedcert...

From above doc:  You might want to create different certificates (signed by the same root CA) to use when configuring SSL in app directories. 

I believe then you don't need to have sslPassword set.