Security
Highlighted

Why is the SDEE script showing my user/pass?

Engager

I think it's ironic to see a security plugin doing something insecurely.. Anyway, here's a rough hack to fix this. Instead of showing the username and password in both the manager->data inputs->scripts section as well as the processlist on the server itself, this reads the username and password from a text file.

Note : This is a hack and not meant to be a final solution. I'm not sure how to modify the setup scripts yet, but it would be much nicer if the final solution were to generate these password files on the fly or give the user the option to use password files or put the data directly in the CLI command.

# Place this code at the bottom of the get_ips_feed.py.
# Comment out the last run() command in that file (it should be the last line)
# and append the following :

#run(sys.argv[1],sys.argv[2],sys.argv[3],"https","yes")

passwd_conf = '/opt/splunk/etc/apps/Splunk_CiscoIPS/local/.ids_passwd'
username = ""
password = ""

try:
        f = open(passwd_conf, 'r')
        user_passwd_arr = f.readline().strip().split(':')
        f.close()
        if (len(user_passwd_arr) != 2):
                sys.exit("The file "+ passwd_conf +" has the wrong syntax")
        else:
                username = user_passwd_arr[0]
                password = user_passwd_arr[1]
except OSError:
        sys.exit("The file "+ passwd_conf +" could not be opened")

run(username,password,sys.argv[3],"https","yes")
Tags (3)
Highlighted

Re: Why is the SDEE script showing my user/pass?

Motivator

Great suggestion and proof of concept. One nitpick though - personally, I'd lean against credentials in a hidden file. Security by obscurity and all that.

Highlighted

Re: Why is the SDEE script showing my user/pass?

Splunk Employee
Splunk Employee

There is an endpoint in 4.2 for storing credentials, which the SDEE app will likely be updated to use.

See this other question

Highlighted

Re: Why is the SDEE script showing my user/pass?

Splunk Employee
Splunk Employee

The current published release is intended to provide backward compatibility with Splunk 4.1.x, which doesn't include the new endpoint. The next maintenance release of the app should include this. Keep an eye out.

0 Karma
Highlighted

Re: Why is the SDEE script showing my user/pass?

Engager

Agreed, however I'm not sure there was an alternative pre splunk 4.2. I'm not familiar with the endpoint in 4.2 yet, so I'm looking forward to seeing how this will work.

0 Karma