Secure your clusters with Pass4SymmKey
Splunk provides a security key to let your search head or indexer clustering nodes authenticate with each other. When you set up an indexer cluster or search head cluster, you assign the same key to each node in the cluster. This key is set in the
pass4SymmKey attribute in
server.conf. This key can be set through Splunk Web, the configuration file, or the CLI. Splunk strongly recommendeds that you set this key.
pass4SymmKey controls intraSplunk authentication and does not manage user access.
pass4SymmKey for search head clustering
pass4SymmKey when you deploy the search head cluster. See Deploy a search head cluster.
For details on configuring
pass4SymmKey on a search head cluster, including how to set it post-deployment, see Set a security key for the search head cluster.
pass4SymmKey for indexer clustering
pass4SymmKey when you deploy the indexer cluster, while enabling the master node. See Enable the indexer cluster master node.
For more details on setting
pass4SymmKey on an indexer cluster, see Configure the security key.
pass4SymmKey gets encrypted in apps
When you specify pass4SymmKey in clear-text for an app directory in a Splunk instance (for example:
etc/apps/myapp/default/server.conf), an obfuscated version is written to the local file (in this example,
system/local/server.conf) upon restart. Usually configuration files in the default directory are read only, and the information is also written to the local file, which is editable.
A password placed directly into an app's local directory (for example:
etc/apps/myapp/local/server.conf), will be replaced with the encrypted version.
When the configuration is listed using
curl or a
splunkd endpoint, the
pass4SymmKey appears encrypted. If the configuration location is read-only, Splunk software likewise writes to local.
Secure your deployment server and clients using certificate authentication
Use Splunk Enterprise to audit your system activity
This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.1.0, 7.1.1, 7.1.2