Security

admin password reset back to default? bug?

Michael
Contributor

I have three indexers in a cluster. We're in the process of taking them offline, in turn, for updates. They are running 6.5.1, we are updating them to 6.5.3.

So, I go to take the first one offline and the admin password does not work. On a whim, I tried the default "changeme" and it worked! The last time we did an update it went from 6.5.0 to 6.5.1. Those are the facts, but the assumption is that it got reset when updating to 6.5.1...?

I've been using Splunk for a half-dozen years, and never seen it reset it's admin password back to default...

Thoughts? Bug? Or, just another one of those snowflake things at my site that no one else has ever seen? 😉

Michael

0 Karma

mattymo
Splunk Employee
Splunk Employee

How did you do the upgrade? tar? rpm?

Like Muebel said, my guess is etc/passwd got moved or overwritten

- MattyMo
0 Karma

Michael
Contributor

Ah, that may be it, the sys-admin for the box is using Salt... when check and get back...

0 Karma

muebel
SplunkTrust
SplunkTrust

Hi Michael,

The admin passwd can get set to default if the etc/passwd file in splunk's installation directory is cleared. Perhaps this is what happened?

Past that, my only readily available explanation is that it was never set to begin with.

If neither of these fit, yeah, file a P4 with support and see if they have any advice.

Please let me know if this answers your question! 😄

Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...