Security

LDAP Authentication Best Practice 6.6.4

halbeisendv
Path Finder

We've been wondering whether modifying the LDAP BIND password through the Web GUI (clustered environment) or modifying /opt/splunk/etc/shcluster/APPNAME/authentication.conf and pushing from the deployer to the search head cluster is a better method. The Web GUI seems easier/faster. The greater goal is to push one authentication.conf to not only the search head cluster, but also a suite of other enterprise servers. Effectively, a one-stop shop for changing one LDAP BIND password in one place rather than several since our Enterprise server count is significant.

0 Karma
1 Solution

sloshburch
Splunk Employee
Splunk Employee

I would recommend controlling it all from an app that is deployed where needed. This will ensure you have captured the exhaustive set of configuration for the LDAP strategy in one app vs having it persist in various locations (or $SPLUNK_HOME/etc/system/local) - which may happen if you set this in the web UI.

This will also ensure you only have to update the config in one location and can have it updated whereever the config is needed. If you did the UI then you'd have to manually go to every UI, log in, navigate to the settings, and make the change there.

Also, you'll likely want the config attribute with the bind password to live in the app's local directory to ensure it becomes hashed (obfuscated) by Splunk after restart. If that config is put in the default directory of your custom app, there's a chance the hashed password gets put in the local directory while the unhashed persists in the default one.

View solution in original post

0 Karma

sloshburch
Splunk Employee
Splunk Employee

I would recommend controlling it all from an app that is deployed where needed. This will ensure you have captured the exhaustive set of configuration for the LDAP strategy in one app vs having it persist in various locations (or $SPLUNK_HOME/etc/system/local) - which may happen if you set this in the web UI.

This will also ensure you only have to update the config in one location and can have it updated whereever the config is needed. If you did the UI then you'd have to manually go to every UI, log in, navigate to the settings, and make the change there.

Also, you'll likely want the config attribute with the bind password to live in the app's local directory to ensure it becomes hashed (obfuscated) by Splunk after restart. If that config is put in the default directory of your custom app, there's a chance the hashed password gets put in the local directory while the unhashed persists in the default one.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...