Clarify and enforce pass4SymmKey and management-port hardening
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 12/100
- Issue type
- Feature
- Clarity
- Needs clarification
- Activity status
- Active
- Tech stack
- ansible, aws
- Domain
- infrastructure, security
Research direction
The payload names no source files, so start by finding where the cluster and search-head pass4SymmKey settings and the AWS security-group inputs are configured in the repository. The first step is not code: the issue asks for an authoritative answer from Splunk Product Security on whether the key must be enforced, warned on, or only documented, so that answer must be recorded before any change. Done means that decision is in the issue, with tests covering the chosen behaviour and no default key deployed.
Written by the indexing model from the issue text.
Description
Context
Security ticket VULN-117685 reports a critical authentication-bypass risk when a Splunk deployment uses the default pass4SymmKey while the management REST API (tcp/8089) is publicly reachable.
SPA currently configures pass4SymmKey for indexer clustering, indexer discovery, and search-head clustering. It is not yet clear whether those settings fully remediate the reported default-key condition on every topology, or whether SPA also needs an explicit deployment-wide setting. AWS network exposure is supplied through configured security-group names, so SPA should also clarify or validate the expected restriction on port 8089.
Investigation
Determine which interpretation is correct:
- This is a permanent Splunk Enterprise security requirement that SPA should enforce for every deployment.
- This is a temporary mitigation until a specific Splunk Enterprise product fix/version is available.
- This is defense-in-depth guidance that SPA should document and optionally validate rather than enforce.
Confirm with Splunk Product Security/Engineering and the supported Splunk Enterprise versions:
- Which
server.confstanza(s) and deployment roles require a non-defaultpass4SymmKey? - Do SPA’s existing cluster and SHC secrets already cover the vulnerable condition?
- Is there a product fix, changed default, or planned release that alters the required remediation?
- Must port 8089 always be private, or are there supported public-access cases with additional controls?
- Should SPA fail validation, emit a warning, generate configuration, or only document the requirement?
Expected outcome
- Record the authoritative answer and supported-version scope in this issue.
- Implement the appropriate permanent control, temporary mitigation, validation, or documentation.
- Ensure any secret value is supplied through environment/vault lookup and is never committed in configuration examples or logs.
- Add tests covering applicable topologies and confirming that no default key is deployed.
- Document secure management-port exposure, including the operator responsibility when existing AWS security groups are referenced.
- Add release notes and migration guidance if existing environments must rotate a key or restart Splunk.
Security note
Do not include exploit details, credentials, key values, or sensitive deployment metadata from VULN-117685 in this public issue.
- Dominant language
- Python
- Stars
- 138
- Forks
- 51
- Avg merge
- 1h 38m
- Merged PRs (30d)
- 48
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from splunk/splunk-platform-automator
-
Difficulty 1/5 Under an hour Newbie friendliness 18/100
splunk/splunk-platform-automator#155 ·
Maintainers usually reply within 1 day
-
enhancement
Difficulty 4/5 3-5 days Newbie friendliness 58/100
splunk/splunk-platform-automator#124 ·
Maintainers usually reply within 1 day
-
enhancement
Difficulty 5/5 Over a week Newbie friendliness 25/100
splunk/splunk-platform-automator#113 ·
Maintainers usually reply within 1 day
-
enhancement
Difficulty 5/5 Over a week Newbie friendliness 25/100
splunk/splunk-platform-automator#96 ·
Maintainers usually reply within 1 day
-
enhancement
Difficulty 5/5 Over a week Newbie friendliness 38/100
splunk/splunk-platform-automator#88 ·
Maintainers usually reply within 1 day
All issues in splunk/splunk-platform-automator
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
roman-corgi/corgisim#327 ·
Maintainers usually reply within 2 days
-
[Bug]: opencode_go chat route drops reasoning_effort (even 'none'), while the same endpoint honors it via custom_llm_provider=openaiPossibly taken @arvindkumar-ship-it claimed this today. Openllm translation
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
BerriAI/litellm#51871 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
PolicyEngine backdates South Carolina’s EITC into 2015–2017Possibly taken @MaxGhenis claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
PolicyEngine/policyengine-us#10944 ·
Maintainers usually reply within 2 days
-
fix(frontend): resolve SSE parser crash on unhandled Ref methods and undefined actions identifierOpenbug
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
kodokbakar/MiroFish-Local#94 ·
Maintainers usually reply within 1 day