Splunk Dev

Storing and retreiving encrypted credentials on Universal Forwarder

andrew207
Path Finder

I need to safely store encrypted credentials on a UF.

I have a scripted input that needs to call an authenticated API endpoint. The authentication is not simple, hence using a scripted input.

I have found that passwords.conf does not work on a UF, as creating the file seems to do nothing and hitting the create endpoint of the UF API returns "Method not allowed" for POST and "Not Implemented" for GET.

Given the UF binary supports the show-decrypted function I should be able to manually encrypt my password and store it that way, but there doesn't seem to be an opposite to show-encrypted to do that. hash-passwd returns a non-reversible hash.

How can I safely store encrypted credentials on a UF within the Splunk ecosystem from an app deployed by a DS?

Labels (2)
Get Updates on the Splunk Community!

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...