topic Re: Deployment Server - Preventing use of Local Created Apps in Splunk Enterprise

Deployment Server - Preventing use of Local Created Apps

shocko — Mon, 07 Feb 2022 11:15:21 GMT

I'm using Splunk Enterprise 8.2.4 with deployment server. I wat to push out all config/apps to my forwarders to prevent server admins adding config/apps locally. To date system admins have been creating their own inputs and dumping data into main, flooding the license usages etc. and I need to stop this happening. I only want approved configs/inputs etc. to be pushed to the forwarders. As such, I have onboarded all my forwarders to deployment server. My first question is:

Q1: How to prevent a user at the system creating an input and pushing data to the indexers? Is their a config item to only accept deployment server deployed inputs?

On a test system I pushed an application I created that disabled the collection of the [WinEventLog://Security]. I found though that that system had received the app but was still pushing those events. Running btool at the forwarder shows:

C:\Program Files\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\local\inputs.conf [WinEventLog://Security]
C:\Program Files\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\local\inputs.conf disabled = 0

So this seems to be the config from when the forwarder was installed ad the windows inputs were selected in the forwarder MSI installation UI.

Q2: How to override this with deployment server i.e. a locally configured input not necessarily in the apps folder?

Re: Deployment Server - Preventing use of Local Created Apps

gcusello — Mon, 07 Feb 2022 11:53:31 GMT

Hi @shocko,

if you configured your target server as a Deployment Client, managed by the Deployment Server, each local update on the target server is deleted at the next DS check.

To avoid every change, it's a good practice to put also deployment_client.conf file in a TA to deploy using the DS.

Ciao.

Giuseppe

Re: Deployment Server - Preventing use of Local Created Apps

shocko — Mon, 07 Feb 2022 13:00:31 GMT

Thanks for the reply. The file C:\Program Files\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\local\inputs.conf would have existed before the system was onboarded onto the deployment server but even after forwarder check-in it persists. So does this not indicate that only apps deployed by deployment server are enforced and locally created ones are not?

Re: Deployment Server - Preventing use of Local Created Apps

gcusello — Mon, 07 Feb 2022 13:10:18 GMT

Hi @shocko,

there are some internal apps that cannot be used and that aren't managed by the Deployment Server, SplunkUniversalForwarder in one of them!

Ciao.

Giuseppe

Re: Deployment Server - Preventing use of Local Created Apps

shocko — Mon, 07 Feb 2022 14:14:03 GMT

OK. That says to me that deployment server can only be used to deliver applications per ya and not to control an arbitrary one ? Or, do you mean that I should deploy this to the SplunkUniversalForwarder app ?

Re: Deployment Server - Preventing use of Local Created Apps

gcusello — Mon, 07 Feb 2022 14:17:35 GMT

Hi @shocko.

DS can be used to deploy and control every App to Clients.

There are some internal app, installed during installation and that cannot be modified, that aren't managed by DS.

Every other App is managed by DS.

Ciao.

Giuseppe

Re: Deployment Server - Preventing use of Local Created Apps

shocko — Tue, 15 Feb 2022 20:44:04 GMT

Hi @gcusello , I don't understand what you man by

To avoid every change, it's a good practice to put also deployment_client.conf file in a TA to deploy using the DS.

Can you elaborate?

Re: Deployment Server - Preventing use of Local Created Apps

gcusello — Wed, 16 Feb 2022 07:13:06 GMT

Hi @shocko,

the correct approach is to create an App (I usually call TA_Forwarders) containing only two files:

deploymentclient.conf (to address and manage the connection with the DS),
outputs.conf (to address and manage the connection with the Indexers).

In this way you have in only one point the configuratins to reach DS and Indexers, so you can easily make every change (e.g. changeing DS or adding an Indexers).

If your client is connected to the DS, every added App or every local change is deleted at the first check.

The only problem is that, when you install a new Forwarder, you have to manually copy this App on the Client and locally restart Splunk, then it's in the managing cycle.

Ciao.

Giuseppe