Splunk says "login failed" when running certain CLI commands on UF. Why?

[russell120k]

When running splunk show deploy-poll or splunk set deploy-poll on the command line of a UF (Linux) I'm prompted to provide a user and password, but receive "Login failed" 100% of the time. I successfully login with those same credentials in the UI of the SH, MC. The credentials are my user credentials (admin role) and not a default user/pass.

Where can I begin investigating this issue?

-Is there a log Splunk writes to locally (this UF is not a deployment client yet) that I can log into to find out why I can't authenticate?

-Is there a conf file I need to look into to diagnose and fix this issue?

I know I can use the -auth tag in the command and provide a user/pass but I don't want my password in the command history of this server.

[yeahnah]

Hi @russell120k 

A UF only stores local passwords.  There is no LDAP or linkage to the Splunk Enterprise password.  Older UFs installed with a default local admin user password, but modern security standards have rightly changed that approach and UFs' will install without any password set nowadays.

On UF...

1. Check if a user has a password set
         cat $SPLUNK_HOME/etc/passwd
a) if this file does not exist then there is no local user defined

b) the file exists with entries - likely just an admin user

2. Reset the password (assuming Linux)

a) Remove $SPLUNK_HOME/etc/passwd (if it exists)

b) Set a new password in user-seed.conf

cat <<EOF >$SPLUNK_HOME/etc/system/local/user-seed.conf
[user_info]
USERNAME = admin
PASSWORD = <your password>
EOF

 b). Restart Splunk
       N.B. user-seed.conf file is deleted on Splunk restart

Note, the user does not have to be called admin, either.

https://docs.splunk.com/Documentation/Splunk/9.0.4/Admin/User-seedconf

It would now be considered good practise to remove the admin user/pass once finished using it (remove passwd file and restart Splunk)

Or, even better simply using Splunk conf files to define the the deployment server - no need for admin

Hope this helps