Security

Splunk 2fa with Google Authenticator?

daniel333
Builder

All,

Has anyone ever setup Google Authenticator with Splunk for 2fa? Any walk throughs available for Splunk Enterprise 8?

sebr12
Engager

Hi daniel333,
I realize that this question was asked quite a while back, but in case this is still an issue for you or anyone else I'll try and answer this question as best I can.
If you already configured your mail settings under Settings -> Server Settings -> Email settings and configured an alert, just as I did and noticed that no mail was sent when the trigger occurred. Then what you could do is run the following search index=_internal source="/opt/splunk/var/log/splunk/python.log" sendemail. This gave me an event stating "Application-specific password required" and referred me to https://support.google.com/mail/?p=InvalidSecondFactor. The link explained who to create an App specific password. This generated password should be pasted in under the mail configuration in your Splunk environment.

The settings I used under splunk was.
Mail host: smtp.gmail.com:587
Email Security: Enable TLS
Username: [my.email@gmail.com]
Password: [The app specific password]

I hope this is of any help to you or anyone else having this issue and if this don't resolve your issue then the SPL query above can still provide valuable information as to where the issue lies.
Best of luck and happy Splunking

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>