topic Re: Splunk needs a shell? in Security

Splunk needs a shell?

daniel333 — Tue, 02 Feb 2021 22:40:14 GMT

All,

Just noticed when Splunk UF installs it creates a user "splunk" with a login shell /bin/bash in /etc/passwd.

e.g.
splunk:1007:/bin/bash

Is that needed? Can I switch it to a nologin? Anyone familiar with the impact of doing that?

Re: Splunk needs a shell?

edoardo_vicendo — Wed, 22 Sep 2021 12:14:30 GMT

As of today on a CentOS 6 server we tested to modify the shell for splunk user from /bin/bash to /sbin/nologin

On this server it is running the Splunk Universal Forwarder.

After having modified the /etc/passwd file and restarted the Splunk Universal Forwarder it is still working, as well as the scripts directly launched by it.

#to modify the shell usermod -s /sbin/nologin splunk #to restart the Universal Forwarder /etc/init.d/splunk restart

Re: Splunk needs a shell?

isoutamo — Wed, 22 Sep 2021 12:38:05 GMT

Personally I prefer to do it just like this. Disable login for splunk user w/o no real shell. And I do the same for both UF and other servers (like indexers, SHs etc.). When it's needed to run something on this user then use just sudo with used shell.

r. Ismo

Re: Splunk needs a shell?

edoardo_vicendo — Wed, 22 Sep 2021 13:52:41 GMT

I think it depends on how you manage your environment. We applied this modification only on a subset of client machines (having UF installed) because the side effect is that you are not able anymore to do "su - splunk".

On a UF it could be acceptable, mainly because you deploy the apps with the Splunk Deployment Server, and because to restart the UF if needed you can leverage on init or systemd.

On the other hand, if you are on a Splunk server (having Splunk Enterprise installed), it is usually necessary to become splunk user to modify configuration files, run CLI commands etc... Of course you can also manage it adding requested commands in sudoers file, but it could take time to define them all, and using wildcards on sudoers file it's not the best choice in term of security. This obviously applies unless you are not root on that machine 🙂

Re: Splunk needs a shell?

isoutamo — Wed, 22 Sep 2021 18:47:32 GMT

You could do sudo -u splunk /bin/bash to get shell and after that works (almost) like after su splunk (w/o - ).