seeking confirmation: there is no way to lockout the splunk admin account?

[vincenp2]

assuming that I want to keep the Splunk admin account, using a very secure complex password, I believe that by design there is no way of locking out this account.

I am seeking confirmation that this is the case, and if so then is there any splunk documentation that actually states this?

I would be grateful if anyone can confirm that this is indeed the case, and point me to any splunk documentation that ratifies this statement

Thanks

[sloshburch]

(Responding fast so apologies if I misunderstood.)

Backup the $SPLUNK/etc/passwd file and then leave an empty file of the same name. This will remove all local accounts and leave Splunk left to auth against LDAP and other sources only.

[_gkollias]

Use password lockout (enabled by default):

Password lockout temporarily locks users out of the system after a certain number of failed attempts. Password lockout is on by default and occurs five attempts. You can specify how many attempts the user has, and how long the lockout period must last. The default is 30 minutes. In less secure environments, you can set the lockout time for longer to be sure that an unverified user cannot access the system.

Here is more on Password best practices for administrators:

https://docs.splunk.com/Documentation/Splunk/7.2.5/Security/Passwordbestpracticesforadministrators

[vincenp2]

Hi - thanks for the quick response - and the document reference - much appreciated

Unfortunately this does not apply to the admin user - I have found that I can input the wrong password in for the admin user 30-40 times in succession, and still it will not lock out at all

This is acceptable, and perhaps understandable, I just need confirmation that this is Splunk working as designed, and not some erroneous setting in my configuration

[_gkollias]

Thanks - I thought you could define admin in this same manner. Do what @SloshBurch mentioned, I think he's right 🙂

[sloshburch]

he he. Glad my payoff to you worked. JK!