Security

What are the capabilities required for enabling/disabling maintenance mode?

splkjk
Explorer

Hello Team, What capabilities are required for enabling and disabling the maintenance mode. Based on the following link https://community.splunk.com/t5/Security/Capabilities-needed-for-a-service-account-to-enable-Mainten... , i did provide the following capability edit_indexer_cluster ,  but no breakthrough.

Labels (2)
0 Karma
1 Solution

SanjayReddy
SplunkTrust
SplunkTrust

Hi @splkjk 

are you trying to enable/disbale maintenace mode from Clustermaster UI?. we dont have option to enable /disable from UI 

 after adding capability edit_indexer_cluster try to execute follwing commands from CLI 

$SPLUNK_HOME$/bin

./splunk show maintenance-mode -auth <splunkusername>:<password>

./splunk enable maintenance-mode <splunkusername>:<password>

./splunk disable maintenance-mode <splunkusername>:<password>

 
 

 

View solution in original post

0 Karma

SanjayReddy
SplunkTrust
SplunkTrust

Hi @splkjk 

are you trying to enable/disbale maintenace mode from Clustermaster UI?. we dont have option to enable /disable from UI 

 after adding capability edit_indexer_cluster try to execute follwing commands from CLI 

$SPLUNK_HOME$/bin

./splunk show maintenance-mode -auth <splunkusername>:<password>

./splunk enable maintenance-mode <splunkusername>:<password>

./splunk disable maintenance-mode <splunkusername>:<password>

 
 

 

0 Karma

splkjk
Explorer

Hi @SanjayReddy , Thanks for the inputs...

nope, I'm not using GUI for enabling or disabling maintenance mode.

we did add edit_indexer_cluster , but when i try to execute enable maintenance with below error

******:~ $ /opt/splunk/bin/splunk enable maintenance-mode
Warning: In maintenance mode, the cluster manager will not attempt to replace any missing replicated or searchable bucket copies. This mode should be enabled only while performing maintenance on peers. Do you want to continue? [y/n]: y
Your session is invalid. Please login.
Splunk username: testuser
Password:
Login failed
call not properly authenticated

 

 

below are the capability added for that role

[role_supp_team]
cumulativeRTSrchJobsQuota = 0
cumulativeSrchJobsQuota = 0
edit_indexer_cluster = enabled
importRoles = user
srchMaxTime = 8640000

0 Karma

SanjayReddy
SplunkTrust
SplunkTrust

Hi @splkjk 

it seems login failed due to  there was issue with username/password, 

please try to use correct username/password, or reset the creds and try again

I am able to to enable/disable maintenance mode from same configuration you mentioned,

have you added role_supp_team to test user under users settings

SanjayReddy_2-1648096207187.png

 

 

 

 

0 Karma

splkjk
Explorer

Hi @SanjayReddy , i am able to login to splunk via GUI , by providing the same id and password. But when I try to execute the enable the maintenance mode on Cluster master, it gets failed  and i do have the same role that is mentioned in your screenshot.

I am still getting the same error

Your session is invalid. Please login.
Splunk username: testuser
Password:
Login failed
call not properly authenticated 

0 Karma

splkjk
Explorer

Hello @SanjayReddy  tried crossing 1 hurdle..

so, our environment is a cluster environment with few search heads and few indexers, a Cluster master and Deployer. so i created user on search head and that was the reason i was able to login to splunk GUI, but not able to enable the maintenance mode on CM. so i have created the same role and user on cluster master and tried executing the maintenance mode , it did get executed, but now with different error, i have provided  edit_indexer_cluster capability, still getting the error, not sure why...., any insights

Your session is invalid. Please login.
Splunk username: testuser
Password:
You (user=testuser) do not have permission to perform this operation (requires capability: edit_indexer_cluster).

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...