Splunk Dev

How to retrieve password from password.conf in python script?

splunker2117
Loves-to-Learn Lots

Please help in reading the credentials from password.conf in python script. 

 

0 Karma

splunker2117
Loves-to-Learn Lots

Here I do not want to expose admin credentials even. Is there any way to read password.conf without passing admin credentials. Basically I need to retrieve secrets while running custom command. 

0 Karma

tcole_splunk
Splunk Employee
Splunk Employee

I'm not sure I understand. You need to pass in credentials in order to read passwords.conf, because this file is encrypted and you need to ensure secure access. In order to call the storage/passwords endpoint, the user needs to belong to a role with certain capabilities assigned. See https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/secretstorage/secretstoragerbac for more details.

0 Karma

splunker2117
Loves-to-Learn Lots

Let me give you bit background @tcole_splunk  @gcusello ,

I've script to run as custom command and secrets are stored in password.conf with the help of setuppage. 

Now I am stuck where unable to read the secrets from password.conf to authenticate 3rd party API.

I've used multiple ways to read password.conf however it is failing to connect at initial stage where it call to splunk rest api to retrieve passwords.conf details. Goal is to get the session key without passing the hardcoded values so can use.

service = client.Service(token=session_key,host="127.0.0.1", port=8089)
0 Karma

tcole_splunk
Splunk Employee
Splunk Employee

Thanks for the additional information. Did you try connecting to Splunk Enterprise with the Python SDK through the connect function? See https://dev.splunk.com/enterprise/docs/devtools/python/sdk-python/howtousesplunkpython/howtoconnectp....

After that, you should be able to retrieve passwords following the example at https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/secretstorage/secretstoragepython....

0 Karma

tcole_splunk
Splunk Employee
Splunk Employee

Hello!

Just to add to what Giuseppe posted, you can retrieve credentials from passwords.conf using the storage/passwords REST API endpoint and the Splunk SDK for Python. Here is the documentation explaining how to do this:

 https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/secretstorage/secretstoragepython

Good luck!

0 Karma

gcusello
SplunkTrust
SplunkTrust
0 Karma
Get Updates on the Splunk Community!

Splunk Certification Support Alert | Pearson VUE Outage

Splunk Certification holders and candidates!  Please be advised of an upcoming system maintenance period for ...

Enterprise Security Content Update (ESCU) | New Releases

In September, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...