topic Re: Installing a universal forwarder using the rpm file, what is the password it's asking for when switching users? in Getting Data In

Installing a universal forwarder using the rpm file, what is the password it's asking for when switching users?

chawagon03 — Tue, 08 Sep 2015 20:25:34 GMT

So I installed Splunk Universal Forwarder using the rpm file provided by Splunk. When I run the given commands rpm -i <splunk>.rpm as root, it installs just fine. But when I try to do 'su - splunk' to switch to the user, it asks for a password. What is this password?!?

Re: Installing a universal forwarder using the rpm file, what is the password it's asking for when switching users?

gcato — Tue, 08 Sep 2015 21:24:09 GMT

Hi Chawagon03,

The splunk user is just like any other user on the LINUX system, so, assuming you're using local authentication, you need to set a local password for the "splunk" user. As the root user (or a system user with appropriate sudo permissions), simply use the "passwd splunk" command and set a password. For example:

root@fwdr:~# passwd splunk
Enter new UNIX password:
Retype new UNIX password:
passwd: password updated successfully
root@fwdr:~#

Hope this helps.

Re: Installing a universal forwarder using the rpm file, what is the password it's asking for when switching users?

grijhwani — Tue, 08 Sep 2015 22:05:31 GMT

The splunk account will be automatically created during the install. Ideally it should not be a login account, and thus should not have a valid password. Anyone with superuser privileges can su to another account without password access. The best way to achieve that for a normal user is sudo (.i.e. as you sudo su - splunk). If depending on how sudo has been set up for your account you may be prompted for a password (which will explicitly be your own current password), or you may be granted unauthenticated rights to perform specific limited or all commands through sudo.

The downside is that it will not be setup for users by default, but it is the accepted "correct" way to perform administrative tasks. Logging in as "root" should only be a last resort.

Re: Installing a universal forwarder using the rpm file, what is the password it's asking for when switching users?

grijhwani — Tue, 08 Sep 2015 22:08:53 GMT

I have to disagree with this. Although you can assign it a password, you should not.

Since splunk services run as root on bootup, the splunk account should not be provided with a login password, and limited su access should be through su-enabled accounts (with sudo).

Re: Installing a universal forwarder using the rpm file, what is the password it's asking for when switching users?

gcato — Tue, 08 Sep 2015 22:51:39 GMT

I can't argue with that and agree your answer is best practise. I guess it all depends on the use case, environment and risk profile that chawagon03 is working with on the approach to take.