topic Re: What is the admin account for on a Universal Forwarder? in Getting Data In

What is the admin account for on a Universal Forwarder?

Glasses — Thu, 25 Jul 2019 21:08:34 GMT

I have UFs on some "sensitive" servers and the owners - that did the install are questioning the purpose of the Admin account.
I have just accepted the fact that all splunk nodes require credentials and an account.
Is there an official document or explanation for the reason a UF needs one?

These are windows servers.
Thank you.

Re: What is the admin account for on a Universal Forwarder?

guilmxm — Thu, 25 Jul 2019 21:33:03 GMT

There are different contexts where CLI or REST access can be used or useful on a Splunk UF, you may want to refer to:

https://docs.splunk.com/Documentation/Splunk/7.3.0/Admin/CLIadmincommands

On a UF specially, for trouble shooting you may run some commands like listing the file monitors, investigating the tailing processor, etc

Example:

splunk _internal call /admin/inputstatus/TailingProcessor:FileStatus

This requires an admin access on the UF.

That being said, in real life in 99% of the cases you never never need to use a CLI or REST access on the UF, as a good practice we generally globally deactivate splunkd REST API on all standard UFs (not HFs !) via the deployment of a simple base config app, which is what I do and recommend to customers.
Whenever you would such thing, you still can re-activate it, and again in most of the cases you don't need it because you would use for bad reasons most likely.

Deactivating via server.conf

[httpServer]
disableDefaultPort = true

So good practice, at installation generate a random complex password for the admin account, and deactivate REST via the deployment of a base config app.

Guilhem

Re: What is the admin account for on a Universal Forwarder?

woodcock — Fri, 26 Jul 2019 20:06:51 GMT

Here:
https://docs.splunk.com/Documentation/Forwarder/latest/Forwarder/InstallaWindowsuniversalforwarderfromaninstaller#Choose_the_Windows_user_that_the_universal_forwarder_should_run_as