
Secure your clusters with pass4SymmKey
Splunk provides a security key that lets your search head or indexer clustering nodes authenticate with each other. When you set up an indexer cluster or search head cluster, you assign the same key to each node in the cluster. You use the pass4SymmKey
setting in the server.conf configuration file. You can set the key using Splunk Web, the configuration file, or the CLI.
The pass4SymmKey
setting controls authentication between Splunk platform instances and does not manage user access.
Configure pass4SymmKey for search head clustering
Configure pass4SymmKey
when you deploy the search head cluster. See Deploy a search head cluster.
For details on configuring pass4SymmKey
on a search head cluster, including how to set it post-deployment, see Set a security key for the search head cluster.
Configure the pass4SymmKey setting for indexer clustering
Configure pass4SymmKey
when you deploy the indexer cluster, while enabling the manager node. See Enable the indexer cluster manager node in the Managing Indexers and Clusters of Indexers Manual.
For more details on setting pass4SymmKey
on an indexer cluster, see Configure the security key in the Managing Indexers and Clusters of Indexers Manual.
How apps encrypt the pass4SymmKey
When you specify pass4SymmKey
in clear-text for an app directory on a Splunk platform instance, for example in the etc/apps/myapp/default/server.conf
file, the software writes an obfuscated version of the key to the local file when you restart the instance. In this example, the software writes the obfuscated key to system/local/server.conf
. Configuration files in the default directory are generally read-only, and the software writes the information to the local file, which is editable.
Placing a password directly into the local directory of an app (for example: etc/apps/myapp/local/server.conf
), replaces it with the encrypted version.
When you use the curl
web data transfer tool to view a configuration file or a splunkd
endpoint, the pass4SymmKey
appears encrypted. If the configuration location is read-only, Splunk software likewise writes to the local directory.
Use OpenSSL to generate a random passphrase for pass4SymmKey
You can use the OpenSSL utilities that come with Splunk software to generate a passphrase that you can use with the pass4SymmKey
setting.
For the strongest security, select a passphrase that is at least 12 characters long and checks out against a dictionary of known bad passphrases, like abc123
, password
, qwerty
, admin
, and so on. The OpenSSL utility that comes with Splunk software lets you randomly generate a passphrase that you can then use to configure pass4SymmKey
with on all nodes of your Splunk deployment.
- On a Splunk platform instance, open a shell prompt.
- Change to the
$SPLUNK_HOME/bin
directory. - Run the following command to generate a random 12-character passphrase:
splunk cmd openssl rand -base64 9
- Copy the output of the command to your clipboard.
- For all machines that you want to use the new passphrase:
- Edit
$SPLUNK_HOME/etc/system/local/server.conf
. - Set
pass4SymmKey = <new passphrase that you just generated>
- Save
$SPLUNK_HOME/etc/system/local/server.conf
. - Restart Splunk software.
- Edit
PREVIOUS Secure deployment servers and clients using certificate authentication |
NEXT Use Splunk Enterprise to audit your system activity |
This documentation applies to the following versions of Splunk® Enterprise: 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 9.0.0, 9.0.1
Feedback submitted, thanks!