Access Control Within DBConnect (DBX)

[jodros]

Does anyone know how to accomplish this? I have tried utilizing the "Restrict search terms" but it is not working. Currently if I allow a user access to DBX they would see all database connections.

Any ideas would be appreciated.

Thanks

[jodros · Accepted solution]

This issue has been corrected with the recent update for dbx.

[Dan]

We just added a topic in the documentation called "Security and access controls" http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Securityandaccesscontrols

In Splunk DB Connect versions 1.0.8 and earlier, database connection objects cannot be restricted to a particular role. When creating a database connection, the credentials you use will be implicitly used by every user that has access to dbquery, dblookup, or any other commands that use the connection. For instance, dbquery myConnection "SELECT * FROM Audit_Table" will not check whether the executing user has rights to the myConnection object. You can, however, limit which roles have access to the dbquery command. By default, only admins have access to dbquery, dblookup, and dboutput commands.

Make sure you use a database account with appropriately limited permissions. The recommended solution to work with databases regarding security (both read-only and read-write), is to limit the permissions of the database user, specified in the database connection, to the minimum necessary to fulfil its tasks. i.e. the user should only have read access (SELECT) to required tables/views. In case of dboutput the user should be granted limited write access as well (INSERT, UPDATE). This configuration needs to be done on the DBMS side - so describing the necessary steps for each DBMS type is out of scope for these docs.

An additional mitigation is to configure the database connection as read-only.

[Dan]

We are working on role-based permissions for database connections. I will update when that is released, but it will not be before July.

[jodros]

This would not accommodate what we need. The only way I can think to currently accomplish our needs is to have separate search heads for different user access within DBX, which isn't optimal. I would love to be able to assign roles to database connections or be able to utilize the restrict search terms to prevent unauthorized access to databases.

Thanks