Splunk® Enterprise

Securing Splunk Enterprise

Download manual as PDF

Download topic as PDF

Secure your clusters with pass4SymmKey

Splunk provides a security key to let your search head or indexer clustering nodes authenticate with each other. When you set up an indexer cluster or search head cluster, you assign the same key to each node in the cluster. This key is set in the pass4SymmKey attribute in server.conf. This key can be set through Splunk Web, the configuration file, or the CLI. Splunk strongly recommendeds that you set this key.

Note that pass4SymmKey controls intraSplunk authentication and does not manage user access.

Configure pass4SymmKey for search head clustering

Configure pass4SymmKey when you deploy the search head cluster. See Deploy a search head cluster.

For details on configuring pass4SymmKey on a search head cluster, including how to set it post-deployment, see Set a security key for the search head cluster.

Configure pass4SymmKey for indexer clustering

Configure pass4SymmKey when you deploy the indexer cluster, while enabling the master node. See Enable the indexer cluster master node.

For more details on setting pass4SymmKey on an indexer cluster, see Configure the security key.

How pass4SymmKey gets encrypted in apps

When you specify pass4SymmKey in clear-text for an app directory in a Splunk instance (for example: etc/apps/myapp/default/server.conf), an obfuscated version is written to the local file (in this example, system/local/server.conf) upon restart. Usually configuration files in the default directory are read only, and the information is also written to the local file, which is editable.

A password placed directly into an app's local directory (for example: etc/apps/myapp/local/server.conf), will be replaced with the encrypted version.

When the configuration is listed using curl or a splunkd endpoint, the pass4SymmKey appears encrypted. If the configuration location is read-only, Splunk software likewise writes to local.

Use OpenSSL to generate a random passphrase for pass4SymmKey

You can use the OpenSSL utilities that come with Splunk software to generate a passphrase that you can use with pass4SymmKey.

For the best security, select a passphrase that is at least 12 characters long and checks out against a dictionary of known bad passphrases, like abc123, password, qwerty, admin and so on. The OpenSSL utility that comes with Splunk software lets you randomly generate a passphrase that you can then use to set pass4SymmKey with on all nodes of your Splunk deployment.

  1. On a Splunk instance, open a shell prompt.
  2. Change to the $SPLUNK_HOME/bin directory.
  3. Run the following command to generate a random 12-character passphrase:
    splunk cmd openssl rand -base64 9
    
  4. Copy the output of the command to your clipboard.
  5. For all machines that you want to use the new passphrase:
    1. Edit $SPLUNK_HOME/etc/system/local/server.conf.
    2. Set pass4SymmKey = <new passphrase that you just generated>
    3. Save $SPLUNK_HOME/etc/system/local/server.conf.
    4. Restart Splunk software.
PREVIOUS
Secure your deployment server and clients using certificate authentication
  NEXT
Use Splunk Enterprise to audit your system activity

This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.1.0, 7.1.1, 7.1.2, 7.1.3


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters