topic Re: capability admin all objects in Security

capability admin all objects

efaundez — Tue, 11 Feb 2020 20:02:12 GMT

good afternoon

I have the following question, there are currently roles in our cluster that have the following restriction srchMaxTime = 3600, but it is validated that certain users are searching for more than 1 hour and I ask if this is due to the cability "admin all object".

any help is appreciated

Cheers

Re: capability admin all objects

nickhills — Wed, 30 Sep 2020 04:10:21 GMT

admin_all_objects

Lets the user access and modify any object in the system regardless of any restrictions set in the objects. For example user objects, search jobs, reports, and knowledge objects. Lets the user bypass any ACL restrictions, much the way root access in a *nix environment does.

https://docs.splunk.com/Documentation/Splunk/8.0.1/Security/Rolesandcapabilities

if you have admin_all_objects all restrictions can be disabled.
Only trusted admins should have that capability

Re: capability admin all objects

efaundez — Wed, 30 Sep 2020 04:10:57 GMT

Good afternoon

Thanks for the answer, but I have performed tests on the servers with a user who has admin_all_object and the ad-hoc searches are limited in the same way, for my example leave the parameter srchMaxTime = 60 and the query ended, but I am validating if the searches programmed are also limited by this parameter.

Re: capability admin all objects

nickhills — Wed, 12 Feb 2020 16:33:40 GMT

Reports and searches can be configured to run with the role of either the user who created them, or the user who runs them.

If a user with higher capabilities creates a search, but is run by a user with lesser role, the search may be configured to run with the higher capabilities.

Re: capability admin all objects

nickhills — Wed, 30 Sep 2020 04:11:00 GMT

Also - its worth noting that if someone has admin_all_objects, it means they can change their own capabilities.

Re: capability admin all objects

efaundez — Wed, 12 Feb 2020 16:36:25 GMT

Of course, with respect to that point we will make the pertinent modifications, but the requirement that we have is how to limit that the programmed searches do not exceed 60 minutes of execution?