topic Does Splunk Forwarder need an interactive login? in Security

Does Splunk Forwarder need an interactive login?

danielteachesit — Mon, 27 Jun 2022 23:28:31 GMT

All,

I've noticed by default that Splunk Forwarder gives itself /bin/bash in /etc/passwd.

e.g.

splunk:x:1001:1001:Splunk Server:/opt/splunkforwarder:/bin/bash

I changed it to the below and restarted:

splunk:x:1001:1001:Splunk Server:/opt/splunkforwarder:/sbin/nologin

Best I can tell there was no impact. Scripted inputs are working as it the monitor stanza's.

Is there any reason I should leave Splunk user with a Shell?

thanks!

Re: Does Splunk Forwarder need an interactive login?

richgalloway — Tue, 28 Jun 2022 00:12:05 GMT

There is no need for the Splunk account to have a shell assigned to it.

Re: Does Splunk Forwarder need an interactive login?

gcusello — Tue, 28 Jun 2022 06:15:12 GMT

Hi @danielteachesit,

the splunk user, assigned as owner to Splunk Universal Forwarders, doesn't need the Linux shell.

I usually disable it in my production installation.

Ciao.

Giuseppe

Re: Does Splunk Forwarder need an interactive login?

isoutamo — Tue, 28 Jun 2022 12:03:45 GMT

You should also lock splunk user not only set shell to nologin. If/when need to use e.g. btool to check what those configurations are, just use "sudo -usplunk bash" command to get shell.