Deployment Architecture

Access Control Within DBConnect (DBX)

jodros
Builder

Does anyone know how to accomplish this? I have tried utilizing the "Restrict search terms" but it is not working. Currently if I allow a user access to DBX they would see all database connections.

Any ideas would be appreciated.

Thanks

0 Karma
1 Solution

jodros
Builder

This issue has been corrected with the recent update for dbx.

View solution in original post

0 Karma

jodros
Builder

This issue has been corrected with the recent update for dbx.

0 Karma

Dan
Splunk Employee
Splunk Employee

We just added a topic in the documentation called "Security and access controls" http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Securityandaccesscontrols

In Splunk DB Connect versions 1.0.8 and earlier, database connection objects cannot be restricted to a particular role. When creating a database connection, the credentials you use will be implicitly used by every user that has access to dbquery, dblookup, or any other commands that use the connection. For instance, dbquery myConnection "SELECT * FROM Audit_Table" will not check whether the executing user has rights to the myConnection object. You can, however, limit which roles have access to the dbquery command. By default, only admins have access to dbquery, dblookup, and dboutput commands.

Make sure you use a database account with appropriately limited permissions. The recommended solution to work with databases regarding security (both read-only and read-write), is to limit the permissions of the database user, specified in the database connection, to the minimum necessary to fulfil its tasks. i.e. the user should only have read access (SELECT) to required tables/views. In case of dboutput the user should be granted limited write access as well (INSERT, UPDATE). This configuration needs to be done on the DBMS side - so describing the necessary steps for each DBMS type is out of scope for these docs.

An additional mitigation is to configure the database connection as read-only.
0 Karma

Dan
Splunk Employee
Splunk Employee

We are working on role-based permissions for database connections. I will update when that is released, but it will not be before July.

0 Karma

jodros
Builder

This would not accommodate what we need. The only way I can think to currently accomplish our needs is to have separate search heads for different user access within DBX, which isn't optimal. I would love to be able to assign roles to database connections or be able to utilize the restrict search terms to prevent unauthorized access to databases.

Thanks

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...