topic Re: /bin/false as loginshell for splunkforwarder in Getting Data In

/bin/false as loginshell for splunkforwarder

HansWurscht — Mon, 29 Sep 2014 07:05:54 GMT

Hi,

is it possible to use /bin/false as a loginshell for the user running splunkforwarder?

The splunkforwarder process seems to work with /bin/false, but running enable boot-start as root doesn't seem to work:

# /opt/splunkforwarder/bin/splunk enable boot-start -user splunk
This account is currently not available.
First-time-run has not finished.  Ignore this error when previewing migration - exiting.

Can someone confirm this behaviour?

Thanks!

Re: /bin/false as loginshell for splunkforwarder

felipetesta — Mon, 29 Sep 2014 08:03:40 GMT

Have you tried to enable boot start while splunk user still has a valid shell, and then changing it back to /bin/false? Does it start at reboot (or "service start splunk")?

Re: /bin/false as loginshell for splunkforwarder

HansWurscht — Tue, 30 Sep 2014 06:45:55 GMT

No. For a clean install process, this should not be needed.

Re: /bin/false as loginshell for splunkforwarder

echalex — Tue, 30 Sep 2014 09:13:59 GMT

Hi HansWurscht,

When you un the enable boot-start, splunk creates the file splunk-launch.conf in /opt/splunkforwarder/etc. The problem seems to be that splunk needs a shell to create this file, so it has the privileges of the splunk user. I can't say whether this is a bug in splunk.

Apart from temporarily enabling a login shell to the splunk user and disabling it immediately after, you can also run the enable command without the -user option and manually edit splunk-launch.conf.

# /opt/splunkforwarder/bin/splunk enable boot-start
edit /opt/splunkforwarder/etc/splunk-launch.conf
make sure it has the line: SPLUNK_OS_USER = splunk
possibly chown splunk:splunk /opt/splunkforwarder/etc/splunk-launch.conf
At least, make sure the splunk user can read the file

Out of curiosity, which OS are you using? This seems to affect at least Debian-based systems.

Re: /bin/false as loginshell for splunkforwarder

dshakespeare_sp — Mon, 28 Sep 2020 17:44:47 GMT

There issue will be different depending on the version of Splunk

Prior to 6.1""/splunks/splunkforwarder/bin/splunk" start --no-prompt --answer-yes would create line in init.d/splunk like

/bin/su - shaky -c "\"/splunks/splunkforwarder/bin/splunk\" start --no-prompt --answer-yes"

At 6.1 things changed a lot. splunk enable boot-start -user shaky now creates a script like
"/splunks/splunkforwarder/bin/splunk" start --no-prompt --answer-yes
Note there is no "su" here The user name is taken from SPLUNK_OS_USER in launch.conf

Using the the pre 6.1 method with a user that has a /bin/false shell will be problematic as /bin/sh - shaky -c it interpretated as
$SHELL -c after "su is run and /bin/false -c will fail

Re: /bin/false as loginshell for splunkforwarder

edoardo_vicendo — Wed, 22 Sep 2021 12:10:58 GMT

As of today on a CentOS 6 server we tested to modify the shell for splunk user from /bin/bash to /sbin/nologin

On this server it is running the Splunk Universal Forwarder.

After having modified the /etc/passwd file and restarted the Splunk Universal Forwarder it is still working, as well as the scripts directly launched by it.

#to modify the shell usermod -s /sbin/nologin splunk #to restart the Universal Forwarder /etc/init.d/splunk restart