Security

seeking confirmation: there is no way to lockout the splunk admin account?

vincenp2
New Member

assuming that I want to keep the Splunk admin account, using a very secure complex password, I believe that by design there is no way of locking out this account.

I am seeking confirmation that this is the case, and if so then is there any splunk documentation that actually states this?

I would be grateful if anyone can confirm that this is indeed the case, and point me to any splunk documentation that ratifies this statement

Thanks

0 Karma

sloshburch
Splunk Employee
Splunk Employee

(Responding fast so apologies if I misunderstood.)

Backup the $SPLUNK/etc/passwd file and then leave an empty file of the same name. This will remove all local accounts and leave Splunk left to auth against LDAP and other sources only.

0 Karma

_gkollias
SplunkTrust
SplunkTrust

Use password lockout (enabled by default):

Password lockout temporarily locks users out of the system after a certain number of failed attempts. Password lockout is on by default and occurs five attempts. You can specify how many attempts the user has, and how long the lockout period must last. The default is 30 minutes. In less secure environments, you can set the lockout time for longer to be sure that an unverified user cannot access the system.

Here is more on Password best practices for administrators:

https://docs.splunk.com/Documentation/Splunk/7.2.5/Security/Passwordbestpracticesforadministrators

0 Karma

vincenp2
New Member

Hi - thanks for the quick response - and the document reference - much appreciated

Unfortunately this does not apply to the admin user - I have found that I can input the wrong password in for the admin user 30-40 times in succession, and still it will not lock out at all

This is acceptable, and perhaps understandable, I just need confirmation that this is Splunk working as designed, and not some erroneous setting in my configuration

0 Karma

_gkollias
SplunkTrust
SplunkTrust

Thanks - I thought you could define admin in this same manner. Do what @SloshBurch mentioned, I think he's right 🙂

0 Karma

sloshburch
Splunk Employee
Splunk Employee

he he. Glad my payoff to you worked. JK!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...