topic Re: ess_admin role issues in Splunk Enterprise Security

ess_admin role issues

astatrial — Wed, 30 Sep 2020 00:11:14 GMT

Hello,
I have a splunk cloud managed deployment which has ES installed on it.

First thing is that my user has only ess_admin role without any other Splunk platform admin role, which according to Splunk docs is necessary for ess_admin role.
(https://docs.splunk.com/Documentation/ES/5.2.2/Install/ConfigureUsersRoles).
Is it really a demand for this role ? I have all the needed ES permissions working just fine at the moment.

Second is that i ran the command | rest /services/authorization/roles and i can see that ess_admin role has access to _internal and _* in the "srchIndexDefault", but for some weird reason i don't really have permissions for those kind of indexes and i can't figure out why.

Thanks for any help!!

Re: ess_admin role issues

astatrial — Wed, 30 Sep 2020 00:11:16 GMT

I think i figured out why it acts like this.

In the srchIndexesAllowed there is nothing, so although that in the srchIndexesDefault there are all the indexes, it doesn't use them.

On the other hand in the srchIndexesAllowed of the user role, there is * which represent according to authorize.conf all the non-internal indexes. So when there is * in ess_admin role Imported_srchIndexesAllowed, it refers to all the non internal indexes.

Still i don't understand if Splunk platform admin role is necessary for ess_admin role...

Re: ess_admin role issues

teunlaan — Thu, 18 Apr 2019 11:27:54 GMT

We are running ES with the ess_admin user only, And it works!.

BUT you need to be sure there are no references to admin in de default.meta.

Some config is "owned by admin" and it will fail is tou don't remove is.
We run this to be sure admin is removed:

find . -type f -name default.meta -exec sed -i 's/owner = admin/#owner = admin/g' {} +

and

find . -name *.meta -type f -print | xargs sed -i '/^access/c\access = read : [ * ], write : [ ess_admin ]'