I think it's ironic to see a security plugin doing something insecurely.. Anyway, here's a rough hack to fix this. Instead of showing the username and password in both the manager->data inputs->scripts section as well as the processlist on the server itself, this reads the username and password from a text file.
Note : This is a hack and not meant to be a final solution. I'm not sure how to modify the setup scripts yet, but it would be much nicer if the final solution were to generate these password files on the fly or give the user the option to use password files or put the data directly in the CLI command.
# Place this code at the bottom of the get_ips_feed.py.
# Comment out the last run() command in that file (it should be the last line)
# and append the following :
#run(sys.argv[1],sys.argv[2],sys.argv[3],"https","yes")
passwd_conf = '/opt/splunk/etc/apps/Splunk_CiscoIPS/local/.ids_passwd'
username = ""
password = ""
try:
f = open(passwd_conf, 'r')
user_passwd_arr = f.readline().strip().split(':')
f.close()
if (len(user_passwd_arr) != 2):
sys.exit("The file "+ passwd_conf +" has the wrong syntax")
else:
username = user_passwd_arr[0]
password = user_passwd_arr[1]
except OSError:
sys.exit("The file "+ passwd_conf +" could not be opened")
run(username,password,sys.argv[3],"https","yes")
... View more
