topic Re: Is it possible to admin Splunk instance without logon to the OS splunk user? in Security

Is it possible to admin Splunk instance without logon to the OS splunk user?

damucka — Fri, 17 Sep 2021 13:02:32 GMT

Hello,

I have an issue with the security of the Splunk installation. Actually it is not about Splunk itself - after each security audit in my company, the OS user Splunk gets turned into the no shell, which means I am not able to switch to it using the su command.

Is it possible at all to run the Splunk instance on Linux without the logon access to the "splunk" OS user?

Surely one could turn the Splunk into the service version, but when I think about creating/changing the configuration files .. they all have to have proper access rights - the easiest is to do it as a "splunk". When operating it as a root, sooner or later there will be an issues with that I would say.

Or is my understanding completely wrong?

Kind Regards,

Kamil

Re: Is it possible to admin Splunk instance without logon to the OS splunk user?

PickleRick — Fri, 17 Sep 2021 13:51:12 GMT

To some extent it depends on your environment. With a simple all-in-one installation you might do with just restarting the process with systemctl. With a clustered installation, to be honest, I don't think I would be able to effectively use it without being able to call splunk to - for example - validate configuration bundle.

But remember that even though the account might have nologin as shell, or something like that, you can always specify your own shell with su 🙂

Re: Is it possible to admin Splunk instance without logon to the OS splunk user?

damucka — Fri, 17 Sep 2021 14:03:38 GMT

@PickleRick

Honestly, your last tip made my day 🙂

Regards,

Kamil

Re: Is it possible to admin Splunk instance without logon to the OS splunk user?

richgalloway — Fri, 17 Sep 2021 14:07:00 GMT

Can you explain to your company's security people that the splunk account is necessary for managing Splunk and that the account needs a shell? Yes, you can use root, but there are bigger security risks to doing that as well as the issues you mentioned.