how to centralized the splunk login account?

[dikaye]

Dear Sir,

We will have two indexer servers for our account login to manage they account founctions, so how to centralized the splunk login account?

[Simon]

You could deploy your $SPLUNK_HOME/etc/passwd. I've done this over multiple indexers/search heads and even over my forwarders.

Or more easier just scp your passwd file to your boxes.

[dikaye]

Thanks for your comment, for the options 2, if I use openldap, seems splunk can't centralized manage the users account.

Actually, what I want is that two indexer servers can centralized manage the users account.

Looking forward to your reply, thanks.

[southeringtonp]

More detail on your environment and what you are trying to accomplish would be helpful. However, the following may be helpful:

In general, you may wish to consult Set up user authentication in the Splunk docs.

The options are:

1. Manually create an account with the same name and password on each indexer.
2. Use LDAP Authentication with an external account store.
3. Use a scripted authentication for RADIUS or to allow complete customization.
4. Use an external authentication source and Splunk's support for single-sign-on.

Options (1) or (2) are usually the easiest to maintain for a small number of indexers. Option (2) is particularly recommended if Active Directory or another LDAP provider is available.