Deployment Architecture

Audit - Tampering of Log Files by Unix Admin Possible?

marcolu5
New Member

I understand that 'Splunk Log Files/Index events' can be deleted (made non-searchable) with the 'can_delete' operators if it is enabled at the application layer. However, if our Splunk instances sits on a Unix Server, could the Unix Admin (i.e. using root, etc.) be able to delete or modify the 'Splunk Log Files/Index events'.

Hoping to provide evidence for our auditors to show that the 'Splunk Logs' are restricted and locked down at both the application and Unix layer. That way we can argue the risk is low and no new controls would need to be implemented.

0 Karma
1 Solution

brian_rampley
Path Finder

Splunk data (indexed data) is stored in $SPLUNK_HOME/var/lib/splunk (by default). If all of $SPLUNK_HOME is owned by the Splunk user, then this path should not be accessible (read or write) by anyone other than the splunk user and root. As long as the default permissions have not been changed, and you have security measures around root access on your servers that meet your audit requirements, you should be fine.

View solution in original post

0 Karma

brian_rampley
Path Finder

Splunk data (indexed data) is stored in $SPLUNK_HOME/var/lib/splunk (by default). If all of $SPLUNK_HOME is owned by the Splunk user, then this path should not be accessible (read or write) by anyone other than the splunk user and root. As long as the default permissions have not been changed, and you have security measures around root access on your servers that meet your audit requirements, you should be fine.

0 Karma

marcolu5
New Member

Thanks for the quick response. Just to confirm. Would a root unix admin on the server have access to manipulate the splunk data (index data) some how? If so, how would he be able to?

0 Karma

brian_rampley
Path Finder

Yes, root will be able to alter indexed data in Splunk by removing (deleting) indexes. This is because root has complete access to the system and can bypass user and group permissions on the server. You should always have proper access controls around root access on your servers.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...