Security

seeking confirmation: there is no way to lockout the splunk admin account?

vincenp2
New Member

assuming that I want to keep the Splunk admin account, using a very secure complex password, I believe that by design there is no way of locking out this account.

I am seeking confirmation that this is the case, and if so then is there any splunk documentation that actually states this?

I would be grateful if anyone can confirm that this is indeed the case, and point me to any splunk documentation that ratifies this statement

Thanks

0 Karma

sloshburch
Ultra Champion

(Responding fast so apologies if I misunderstood.)

Backup the $SPLUNK/etc/passwd file and then leave an empty file of the same name. This will remove all local accounts and leave Splunk left to auth against LDAP and other sources only.

0 Karma

_gkollias
SplunkTrust
SplunkTrust

Use password lockout (enabled by default):

Password lockout temporarily locks users out of the system after a certain number of failed attempts. Password lockout is on by default and occurs five attempts. You can specify how many attempts the user has, and how long the lockout period must last. The default is 30 minutes. In less secure environments, you can set the lockout time for longer to be sure that an unverified user cannot access the system.

Here is more on Password best practices for administrators:

https://docs.splunk.com/Documentation/Splunk/7.2.5/Security/Passwordbestpracticesforadministrators

0 Karma

vincenp2
New Member

Hi - thanks for the quick response - and the document reference - much appreciated

Unfortunately this does not apply to the admin user - I have found that I can input the wrong password in for the admin user 30-40 times in succession, and still it will not lock out at all

This is acceptable, and perhaps understandable, I just need confirmation that this is Splunk working as designed, and not some erroneous setting in my configuration

0 Karma

_gkollias
SplunkTrust
SplunkTrust

Thanks - I thought you could define admin in this same manner. Do what @SloshBurch mentioned, I think he's right 🙂

0 Karma

sloshburch
Ultra Champion

he he. Glad my payoff to you worked. JK!

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!