topic Re: Is there any reason not to run Splunk as root? in Getting Data In

Is there any reason not to run Splunk as root?

MikeBertelsen — Mon, 10 Nov 2014 16:19:17 GMT

Trying to create a Data Input on a forwarder using TCP Port 514. Can't do it as the splunk id. No problem creating DI using port 5514.

Re: Is there any reason not to run Splunk as root?

richgalloway — Mon, 10 Nov 2014 16:51:10 GMT

Ports 0-1024 are protected. Only root can use them.

To address the question, yes, there are reasons to not run Splunk as root. Company policy may prohibit it. Security best practices say only system processes should run as root. Any program running as root may have a weakness that can be exploited to give an outsider a way into your system. That said, some things (like opening port 514) can only be done by root.

Re: Is there any reason not to run Splunk as root?

ppablo — Mon, 10 Nov 2014 19:09:35 GMT

There have been a couple previous questions here on Answer that address this topic such as this post: http://answers.splunk.com/answers/145385/should-we-run-splunk-as-root-or-non-root-user.html

Pretty much the same security issue and best practice that @richgalloway points out.

Re: Is there any reason not to run Splunk as root?

martin_mueller — Mon, 10 Nov 2014 20:37:29 GMT

If you have to receive data on 514, consider setting up an iptables entry for 514 to reroute it to a local port >1024 and have non-root Splunk listen to that.