Deployment Architecture

Installing universal forwarder, can the Splunk user be a system user?

New Member

I'm working on a linux machine hardened according to Center of Internet Security (CIS) hardening benchmarks.  This means its critical to determine, when installing a user "splunk" for the splunk universal forwarder,  if the splunk user should be classified as a system user (useradd -r -m) or an interactive user (useradd -m). 

Normally user added just to facilitate running software should be a system user - that would be least privilege and would be my best guess at how the splunk user should be configured.   Under the CIS hardening scheme, system users are prohibited from having passwords (the password is locked, and also prohibited from launching an interactive shell (the shell is set to /sbin/nologin).    This is done so that an attacker cannot assume the splunk user (via ssh or otherwise,  and gain interactive shell privileges.

I've noted in the splunk documentation that "useradd -m" is specified, without the -r, indicating that the splunk user requires interactive user privileges (password/shell access).   Just checking if this is indeed the case, or if I can safely remove this privilege and make the splunk user a system user (no login or shell permitted).

Labels (1)
0 Karma


Both Splunk Enterprise and Splunk UF will run without a problem under a system user without interactive logon privileges (no password, no login shell). This is pretty typical for a Splunk deployment for the exact reasons you've stated.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...