Security

What are the capabilities required for enabling/disabling maintenance mode?

splkjk
Explorer

Hello Team, What capabilities are required for enabling and disabling the maintenance mode. Based on the following link https://community.splunk.com/t5/Security/Capabilities-needed-for-a-service-account-to-enable-Mainten... , i did provide the following capability edit_indexer_cluster ,  but no breakthrough.

Labels (2)
0 Karma
1 Solution

SanjayReddy
Builder

Hi @splkjk 

are you trying to enable/disbale maintenace mode from Clustermaster UI?. we dont have option to enable /disable from UI 

 after adding capability edit_indexer_cluster try to execute follwing commands from CLI 

$SPLUNK_HOME$/bin

./splunk show maintenance-mode -auth <splunkusername>:<password>

./splunk enable maintenance-mode <splunkusername>:<password>

./splunk disable maintenance-mode <splunkusername>:<password>

 
 

 

----
Regards,
Sanjay Reddy

----
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

SanjayReddy
Builder

Hi @splkjk 

are you trying to enable/disbale maintenace mode from Clustermaster UI?. we dont have option to enable /disable from UI 

 after adding capability edit_indexer_cluster try to execute follwing commands from CLI 

$SPLUNK_HOME$/bin

./splunk show maintenance-mode -auth <splunkusername>:<password>

./splunk enable maintenance-mode <splunkusername>:<password>

./splunk disable maintenance-mode <splunkusername>:<password>

 
 

 

----
Regards,
Sanjay Reddy

----
If this reply helps you, Karma would be appreciated.
0 Karma

splkjk
Explorer

Hi @SanjayReddy , Thanks for the inputs...

nope, I'm not using GUI for enabling or disabling maintenance mode.

we did add edit_indexer_cluster , but when i try to execute enable maintenance with below error

******:~ $ /opt/splunk/bin/splunk enable maintenance-mode
Warning: In maintenance mode, the cluster manager will not attempt to replace any missing replicated or searchable bucket copies. This mode should be enabled only while performing maintenance on peers. Do you want to continue? [y/n]: y
Your session is invalid. Please login.
Splunk username: testuser
Password:
Login failed
call not properly authenticated

 

 

below are the capability added for that role

[role_supp_team]
cumulativeRTSrchJobsQuota = 0
cumulativeSrchJobsQuota = 0
edit_indexer_cluster = enabled
importRoles = user
srchMaxTime = 8640000

0 Karma

SanjayReddy
Builder

Hi @splkjk 

it seems login failed due to  there was issue with username/password, 

please try to use correct username/password, or reset the creds and try again

I am able to to enable/disable maintenance mode from same configuration you mentioned,

have you added role_supp_team to test user under users settings

SanjayReddy_2-1648096207187.png

 

 

 

 

----
Regards,
Sanjay Reddy

----
If this reply helps you, Karma would be appreciated.
0 Karma

splkjk
Explorer

Hi @SanjayReddy , i am able to login to splunk via GUI , by providing the same id and password. But when I try to execute the enable the maintenance mode on Cluster master, it gets failed  and i do have the same role that is mentioned in your screenshot.

I am still getting the same error

Your session is invalid. Please login.
Splunk username: testuser
Password:
Login failed
call not properly authenticated 

0 Karma

splkjk
Explorer

Hello @SanjayReddy  tried crossing 1 hurdle..

so, our environment is a cluster environment with few search heads and few indexers, a Cluster master and Deployer. so i created user on search head and that was the reason i was able to login to splunk GUI, but not able to enable the maintenance mode on CM. so i have created the same role and user on cluster master and tried executing the maintenance mode , it did get executed, but now with different error, i have provided  edit_indexer_cluster capability, still getting the error, not sure why...., any insights

Your session is invalid. Please login.
Splunk username: testuser
Password:
You (user=testuser) do not have permission to perform this operation (requires capability: edit_indexer_cluster).

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...