Security

What are the capabilities required for enabling/disabling maintenance mode?

splkjk
Explorer

Hello Team, What capabilities are required for enabling and disabling the maintenance mode. Based on the following link https://community.splunk.com/t5/Security/Capabilities-needed-for-a-service-account-to-enable-Mainten... , i did provide the following capability edit_indexer_cluster ,  but no breakthrough.

Labels (2)
0 Karma
1 Solution

SanjayReddy
SplunkTrust
SplunkTrust

Hi @splkjk 

are you trying to enable/disbale maintenace mode from Clustermaster UI?. we dont have option to enable /disable from UI 

 after adding capability edit_indexer_cluster try to execute follwing commands from CLI 

$SPLUNK_HOME$/bin

./splunk show maintenance-mode -auth <splunkusername>:<password>

./splunk enable maintenance-mode <splunkusername>:<password>

./splunk disable maintenance-mode <splunkusername>:<password>

 
 

 

View solution in original post

0 Karma

SanjayReddy
SplunkTrust
SplunkTrust

Hi @splkjk 

are you trying to enable/disbale maintenace mode from Clustermaster UI?. we dont have option to enable /disable from UI 

 after adding capability edit_indexer_cluster try to execute follwing commands from CLI 

$SPLUNK_HOME$/bin

./splunk show maintenance-mode -auth <splunkusername>:<password>

./splunk enable maintenance-mode <splunkusername>:<password>

./splunk disable maintenance-mode <splunkusername>:<password>

 
 

 

0 Karma

splkjk
Explorer

Hi @SanjayReddy , Thanks for the inputs...

nope, I'm not using GUI for enabling or disabling maintenance mode.

we did add edit_indexer_cluster , but when i try to execute enable maintenance with below error

******:~ $ /opt/splunk/bin/splunk enable maintenance-mode
Warning: In maintenance mode, the cluster manager will not attempt to replace any missing replicated or searchable bucket copies. This mode should be enabled only while performing maintenance on peers. Do you want to continue? [y/n]: y
Your session is invalid. Please login.
Splunk username: testuser
Password:
Login failed
call not properly authenticated

 

 

below are the capability added for that role

[role_supp_team]
cumulativeRTSrchJobsQuota = 0
cumulativeSrchJobsQuota = 0
edit_indexer_cluster = enabled
importRoles = user
srchMaxTime = 8640000

0 Karma

SanjayReddy
SplunkTrust
SplunkTrust

Hi @splkjk 

it seems login failed due to  there was issue with username/password, 

please try to use correct username/password, or reset the creds and try again

I am able to to enable/disable maintenance mode from same configuration you mentioned,

have you added role_supp_team to test user under users settings

SanjayReddy_2-1648096207187.png

 

 

 

 

0 Karma

splkjk
Explorer

Hi @SanjayReddy , i am able to login to splunk via GUI , by providing the same id and password. But when I try to execute the enable the maintenance mode on Cluster master, it gets failed  and i do have the same role that is mentioned in your screenshot.

I am still getting the same error

Your session is invalid. Please login.
Splunk username: testuser
Password:
Login failed
call not properly authenticated 

0 Karma

splkjk
Explorer

Hello @SanjayReddy  tried crossing 1 hurdle..

so, our environment is a cluster environment with few search heads and few indexers, a Cluster master and Deployer. so i created user on search head and that was the reason i was able to login to splunk GUI, but not able to enable the maintenance mode on CM. so i have created the same role and user on cluster master and tried executing the maintenance mode , it did get executed, but now with different error, i have provided  edit_indexer_cluster capability, still getting the error, not sure why...., any insights

Your session is invalid. Please login.
Splunk username: testuser
Password:
You (user=testuser) do not have permission to perform this operation (requires capability: edit_indexer_cluster).

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...