assuming that I want to keep the Splunk admin account, using a very secure complex password, I believe that by design there is no way of locking out this account.
I am seeking confirmation that this is the case, and if so then is there any splunk documentation that actually states this?
I would be grateful if anyone can confirm that this is indeed the case, and point me to any splunk documentation that ratifies this statement
(Responding fast so apologies if I misunderstood.)
$SPLUNK/etc/passwd file and then leave an empty file of the same name. This will remove all local accounts and leave Splunk left to auth against LDAP and other sources only.
Use password lockout (enabled by default):
Password lockout temporarily locks users out of the system after a certain number of failed attempts. Password lockout is on by default and occurs five attempts. You can specify how many attempts the user has, and how long the lockout period must last. The default is 30 minutes. In less secure environments, you can set the lockout time for longer to be sure that an unverified user cannot access the system.
Here is more on Password best practices for administrators:
Hi - thanks for the quick response - and the document reference - much appreciated
Unfortunately this does not apply to the admin user - I have found that I can input the wrong password in for the admin user 30-40 times in succession, and still it will not lock out at all
This is acceptable, and perhaps understandable, I just need confirmation that this is Splunk working as designed, and not some erroneous setting in my configuration