Secure your clusters with pass4SymmKey
Splunk provides a security key to let your search head or indexer clustering nodes authenticate with each other. When you set up an indexer cluster or search head cluster, you assign the same key to each node in the cluster. You use the
pass4SymmKey setting in the
server.conf file. You can set the key through Splunk Web, the configuration file, or the CLI.
pass4SymmKey controls authentication between Splunk platform instances. It does not manage user access, nor does it negate the need to use valid SSL/TLS certificates to secure the instances.
Configure pass4SymmKey for search head clustering
pass4SymmKey when you deploy the search head cluster. See Deploy a search head cluster.
For details on configuring
pass4SymmKey on a search head cluster, including how to set it post-deployment, see Set a security key for the search head cluster.
Configure pass4SymmKey for indexer clustering
pass4SymmKey when you deploy the indexer cluster, while enabling the master node. See Enable the indexer cluster master node.
For more details on setting
pass4SymmKey on an indexer cluster, see Configure the security key.
How apps encrypt pass4SymmKey
When you specify
pass4SymmKey in clear-text for an app directory on a Splunk instance (for example:
etc/apps/myapp/default/server.conf), the software writes an obfuscated version of the key to the local file (in this example,
system/local/server.conf) when you restart the instance. Configuration files in the default directory are generally read-only, and the software writes the information to the local file, which is editable.
Placing a password directly into an app's local directory (for example:
etc/apps/myapp/local/server.conf), replaces it with the encrypted version.
When the configuration is listed using
curl or a
splunkd endpoint, the
pass4SymmKey appears encrypted. If the configuration location is read-only, Splunk software likewise writes to local.
Use OpenSSL to generate a random passphrase for pass4SymmKey
You can use the OpenSSL utilities that come with Splunk software to generate a passphrase that you can use with
For the strongest security, select a passphrase that is at least 12 characters long and checks out against a dictionary of known bad passphrases, like
admin, and so on. The OpenSSL utility that comes with Splunk software lets you randomly generate a passphrase that you can then use to set
pass4SymmKey with on all nodes of your Splunk deployment.
- On a Splunk instance, open a shell prompt.
- Change to the
- Run the following command to generate a random 12-character passphrase:
splunk cmd openssl rand -base64 9
- Copy the output of the command to your clipboard.
- For all machines that you want to use the new passphrase:
pass4SymmKey = <new passphrase that you just generated>
- Restart Splunk software.
Secure your deployment server and clients using certificate authentication
Use Splunk Enterprise to audit your system activity
This documentation applies to the following versions of Splunk® Enterprise: 6.5.7, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13
Feedback submitted, thanks!