Security

Signature mismatch between license slave, but why key/secret are the same?

rafiwicht
Explorer

I reinstalled Splunk with clustering today. The problem is that I keep getting 'Signature mismatch between license slave' errors. I have the same Splunk Secret on all servers. Therefore I added the key already encrypted with the Splunk Secret in the server.conf for the installation.
I have already tried the following things:

  • Decrypt Pass4SymmKey: works!
  • Pass4SymmKey into 'etc/system/local/server.conf': No effect!
  • New pass4SymmKey added: No effect!
  • Reinstalled: No effect!

Is this a bug or am I missing something fundamental?

Thanks for your help.

Rafael

Labels (1)
0 Karma
1 Solution

rafiwicht
Explorer

Hi

I solved the problem with a work colleague. The problem wasn't that the signature didn't match. The error was that I accidentally entered a remote URI for the license master on the license master. However, the remote URI pointed to the server itself. But that doesn't work. The error message is simply misleading.

Greetings Rafael

View solution in original post

0 Karma

rafiwicht
Explorer

Hi

I solved the problem with a work colleague. The problem wasn't that the signature didn't match. The error was that I accidentally entered a remote URI for the license master on the license master. However, the remote URI pointed to the server itself. But that doesn't work. The error message is simply misleading.

Greetings Rafael

0 Karma

codebuilder
SplunkTrust
SplunkTrust

The pass4SymmKey in the [general] stanza must match across your entire cluster.

For indexer clustering, the pass4SymmKey must also be set in the [clustering] stanza on the master and all indexers, and obviously match.

Master:
[clustering]
mode = master
pass4SymmKey = index_cluster_pw
...

Indexers:
[clustering]
mode = slave
pass4SymmKey = index_cluster_pw
...

----
An upvote would be appreciated and Accept Solution if it helps!

rafiwicht
Explorer

It matches across thze entire cluster.

0 Karma

codebuilder
SplunkTrust
SplunkTrust

Are you running the license master on a dedicated node or one that also performs another Splunk role?

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

rafiwicht
Explorer

I solved the problem. Look the post below. Thank for your help.

0 Karma

codebuilder
SplunkTrust
SplunkTrust

Glad to help!

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

codebuilder
SplunkTrust
SplunkTrust

Also, be sure to add the pass4SymmKey in plain text and cycle Splunk. Don't copy over the encrypted value from another host.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

603_Dan
New Member

This 100% helped me when I was having trouble licensing a slave node to the master and receiving the same error. Copying the unencrypted key into server.conf and then restarting Splunk made all the difference.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...