Security

Is there a Splunk account lockout for users if you enter your password multiple times?

inventsekar
Ultra Champion

Hi
As all my splunk projects are using LDAP for login, this issue never occurred to me.
1. if we configure splunk's local authentication system and create users, and when the users type wrong password for multiple times, will their account get locked out?
2. For all kinds of users (normal, power, admin) users as well?
3. with any login systems(splunk's own authentication/LDAP/etc), does splunk records the users login/logouts/lockouts, password failures?

EDIT:
This task applies to Splunk Enterprise native authentication and does not apply to SAML or LDAP passwords.
In Splunk Web, click Settings > Access Controls > Password Policy Management.

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@inventsekar ,

From 7.1.0 ,
1. you can configure the lock out period and number of failed attempts. Refer List of password policy configurations
2. For the "admin" privileged users, it doesn't seem to lock the account
3. For the authentication failures, it should be recorded in "_audit" logs for e.g. action="login attempt"

Happy Splunking!

View solution in original post

renjith_nair
SplunkTrust
SplunkTrust

@inventsekar ,

From 7.1.0 ,
1. you can configure the lock out period and number of failed attempts. Refer List of password policy configurations
2. For the "admin" privileged users, it doesn't seem to lock the account
3. For the authentication failures, it should be recorded in "_audit" logs for e.g. action="login attempt"

Happy Splunking!

jhomerlopez
Explorer

Even admin and other privileged users can have a lock out policy. There is a capability inside roles management named "never_lockout". You just have to removed it under the "admin" default role.

inventsekar
Ultra Champion

we are on Splunk 7x, but still no results for ...
index="_audit" action=*login*

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

One of the envs which is running on 6.6.2 with LDAP authentication has the following entry which confirms the logging of external authentication system.

Audit:[timestamp=09-13-2018 06:17:23.690, user=xxxxxx, action=login attempt, info=succeeded, src=0.0.0.0][n/a]

Which auth mechanism are you using?

Happy Splunking!
0 Karma

inventsekar
Ultra Champion

we are using some scripted authentication...
After doing some tweekings, i am able to find the info required..

eventtype=splunk_access
index=_* info=succeeded
index=_audit info=succeeded
index=_audit eventtype=splunk_access

will do some more searching and once i am clear of all doubts, i will accept this as answer..

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...