topic Re: Should we run Splunk as root or non-root user? in Security

Should we run Splunk as root or non-root user?

hadinh — Tue, 15 Jul 2014 16:50:24 GMT

Should we run Splunk as root or non-root user? Which way is better?

Thanks
-Ha

Re: Should we run Splunk as root or non-root user?

rmorlen — Tue, 15 Jul 2014 17:09:46 GMT

Splunk recommends that you don't run as root.

Other info: Deploying Splunk

Re: Should we run Splunk as root or non-root user?

Ayn — Tue, 15 Jul 2014 17:19:36 GMT

Best practice in general is to run applications as non-admin users whenever possible. This is a defense-in-depth thing - if an attacker were somehow to be able to compromise the Splunk instance in one way or another and access the underlying operating system through it, it's obviously preferable that Splunk (and therefore the attacker in our scenario) doesn't have administrative privileges.

Re: Should we run Splunk as root or non-root user?

strive — Wed, 16 Jul 2014 02:43:27 GMT

Thanks for the information.

Re: Should we run Splunk as root or non-root user?

strive — Wed, 16 Jul 2014 02:43:29 GMT

Thanks for the information.

Re: Should we run Splunk as root or non-root user?

hadinh — Wed, 16 Jul 2014 12:12:10 GMT

Thanks for your info.

Re: Should we run Splunk as root or non-root user?

bandit — Mon, 25 Aug 2014 13:49:32 GMT

Seems the local system account on Windows (default for Splunk Windows installs) is a very near equivalent of root on Unix, however I don't think that is called out as a security risk the same way as root is.

Re: Should we run Splunk as root or non-root user?

bandit — Mon, 25 Aug 2014 14:18:56 GMT

Great topic. I'd love to see more details in the documentation on best security practices for collection methods. Maybe a matrix?

syslog - Great for many network devices, however doesn't usually work for Webservers/App Servers which don't write out in the syslog format on Unix
Running as root (security implications)
Making logs world readable (security implications)
Add Splunk to a group which has read permissions to logs (My first choice, however there is usually a limit of 16 groups per Unix ID and sometimes an entprise may have hundreds of groups that log files are owned by)
Unix ACLs - May be a great alternative, however how difficult are they to manage?
Mounting logs remotely?

Re: Should we run Splunk as root or non-root user?

jspears — Thu, 28 May 2015 14:24:30 GMT

> Splunk recommends that you don't run as root.

I'm looking for a citation in the online docs, but not finding any specific recommendation. A recommendation from Splunk would be helpful in forming or justifying our own policy. All I have found so far is Run Splunk Enterprise as a different or non-root user

Re: Should we run Splunk as root or non-root user?

highsplunker — Sat, 30 Jan 2021 16:32:38 GMT

Here's the source from docs:

https://docs.splunk.com/Documentation/Splunk/8.1.1/Installation/RunSplunkasadifferentornon-rootuser

In section "Run Splunk Enterprise as a different or non-root user":

It says:

"On *nix based systems, you can run Splunk Enterprise as a user other than root. This is a Splunk best practice and you should configure your systems to run the software as a non-root user where possible."