Deploy secure passwords across multiple servers

When you Install Splunk Enterprise, it creates a file called splunk.secret in the $SPLUNK_HOME/etc/auth directory. This file contains a key that Splunk Enterprise uses to encrypt some of your authentication information in its configuration files.

The following files can have authentication information encrypted within them. Passwords and encryption methods that each file uses are not necessarily interchangeable.

Configuration file	Purpose	What can be encrypted
authentication.conf	Authentication	Any Lightweight directory access protocol (LDAP) passwords (bindDNPassword, attributeQuerySoapPassword settings.)
inputs.conf	Splunk platform data inputs	TLS/SSL passwords (sslPassword setting) for splunktcp-ssl inputs, for data distribution
outputs.conf	Splunk platform data forwarding configurations	TLS/SSL passwords (sslPassword setting) for when you need to configure splunktcp-ssl outputs for receiving data from TLS inputs that you configure in the inputs.conf file
passwords.conf	Credential information for apps	Passwords for a specific app ( password setting).
server.conf	Splunk Enterprise server configurations	Any pass4Symmkeys that you use to secure connections between Splunk Enterprise components. For more information on this setting, see Secure Splunk Enterprise services with pass4SymmKey.
web.conf	Splunk Web and associated services	TLS/SSL passwords (sslPassword setting) for each instance.

When Splunk Enterprise starts, it checks all its configuration files for clear-text passwords. If it detects a clear-text password for one of the previously-specified settings, it creates or overwrites the value for that setting with the encrypted password value.

In a search head cluster, the search head cluster captain replicates its splunk.secret file to all other cluster members during initial deployment of the cluster. You do not need to copy the file manually. As part of its normal operation, the cluster also automatically replicates any credentials that are stored by apps for their own use.

If you specify a password value for either the pass4SymmKey or sslPassword settings in clear text within the default directory of an app, Splunk Enterprise obfuscates the values in the local configuration directory for the app when you restart it. The value for the setting still appears in clear text within the app default configuration directory. If you display the contents of the file using REST, the password prints in encrypted format.