topic Re: Block access to Manager in Splunk Search

Block access to Manager

steveirogers — Wed, 22 Jun 2011 16:19:09 GMT

I have seen several questions about restricting access to "Manager" but all of the answers seem to require coding JavaScript.
I do not understand why this is not a "built-in" capability.

I have defined a new role that only has search capability to a specific index. Yet the users in that role have administrative ability via the "Manager" link to change configuration settings. That does not make any sense.

Is there a different way to accomplish this besides coding/modify XML?

I am running Splunk 4.0.3 build 65638.

Re: Block access to Manager

mfrost8 — Thu, 23 Jun 2011 19:24:56 GMT

I don't have a solution for you, but perhaps more of a question. Is it your intent to prevent non-admin users from being able to say, change their password? non-admin users don't get all the of the admin content from manager. In our shop, we leave that all alone as there's nothing sensitive or damaging that non-admin roles get access to.

If it really has to go away completely for non-admins, I would think that that is unusual enough that yes, you'd need to modify the XML.

Re: Block access to Manager

steveirogers — Thu, 23 Jun 2011 19:45:08 GMT

Thanks very much. I did some more testing and you are correct in that most of the actual fields are restricted when the user clicks on the manager link. However, if the user goes to "Manager --> Field Extractions", then it appears that they can change some of the values in "transforms.conf" and save the changes.

Re: Block access to Manager

mfrost8 — Thu, 23 Jun 2011 19:53:21 GMT

I'm not certain how that works. I would guess that might create configuration within a user's own, local configuration ($SPLUNK_HOME/etc/users/) so it's not tweaking the global config.

If you don't even want that, you might want to file an enhancement request asking for field extractions to be a capability you can remove from the "user" role (I don't see it there currently as a capability).

Re: Block access to Manager

mw — Thu, 23 Jun 2011 20:34:31 GMT

The Manager link doesn't immediately just give them admin access. Users have their own "knowledge objects" such as searches and macros. They access to these through Manager. They have access to what they create or what you give them access to. If you don't want them to have access to something, manage the permissions of it.

Re: Block access to Manager

frankfowler — Tue, 14 Feb 2012 23:07:18 GMT

you can control what is displayed on the Manager page via the authorize.conf file.

more info here :

http://docs.splunk.com/Documentation/Splunk/4.3/admin/Addandeditroles#List_of_available_capabilities

Re: Block access to Manager

steveirogers — Wed, 15 Feb 2012 13:23:35 GMT

Thanks Frank. I will check into that as well.