I'm working on a linux machine hardened according to Center of Internet Security (CIS) hardening benchmarks. This means its critical to determine, when installing a user "splunk" for the splunk universal forwarder, if the splunk user should be classified as a system user (useradd -r -m) or an interactive user (useradd -m).
Normally user added just to facilitate running software should be a system user - that would be least privilege and would be my best guess at how the splunk user should be configured. Under the CIS hardening scheme, system users are prohibited from having passwords (the password is locked, and also prohibited from launching an interactive shell (the shell is set to /sbin/nologin). This is done so that an attacker cannot assume the splunk user (via ssh or otherwise, and gain interactive shell privileges.
I've noted in the splunk documentation that "useradd -m" is specified, without the -r, indicating that the splunk user requires interactive user privileges (password/shell access). Just checking if this is indeed the case, or if I can safely remove this privilege and make the splunk user a system user (no login or shell permitted).
