- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
As I prepare for the 24 lab exam, I see these different naming for the CLI secret parameter versus the pass4SymmKey in the configuration files. Why is it?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I’ll give it a go to explain; The splunk.secret is the encryption key used by Splunk for most passwords that you enter into most configuration files. When Splunk detects a plaintext password, it will encrypt the password using the splunk.secret key. You can tell that a password has been encrypted when the password string begins with “$1$”—this value is used by Splunk to determine if the password has been encrypted.
When you specify pass4SymmKey in clear-text for an app directory on a Splunk instance (for example: etc/apps/myapp/default/server.conf), the software writes an obfuscated version of the key to the local file (in this example, system/local/server.conf) when you restart the instance. This is done with splunk.secret....
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I’ll give it a go to explain; The splunk.secret is the encryption key used by Splunk for most passwords that you enter into most configuration files. When Splunk detects a plaintext password, it will encrypt the password using the splunk.secret key. You can tell that a password has been encrypted when the password string begins with “$1$”—this value is used by Splunk to determine if the password has been encrypted.
When you specify pass4SymmKey in clear-text for an app directory on a Splunk instance (for example: etc/apps/myapp/default/server.conf), the software writes an obfuscated version of the key to the local file (in this example, system/local/server.conf) when you restart the instance. This is done with splunk.secret....
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It makes sense @Azeemering - much appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Any ideas about this one, by any chance?
