Getting Data In

Installing a universal forwarder using the rpm file, what is the password it's asking for when switching users?

chawagon03
Path Finder

So I installed Splunk Universal Forwarder using the rpm file provided by Splunk. When I run the given commands rpm -i <splunk>.rpm as root, it installs just fine. But when I try to do 'su - splunk' to switch to the user, it asks for a password. What is this password?!?

0 Karma

grijhwani
Motivator

The splunk account will be automatically created during the install. Ideally it should not be a login account, and thus should not have a valid password. Anyone with superuser privileges can su to another account without password access. The best way to achieve that for a normal user is sudo (.i.e. as you sudo su - splunk). If depending on how sudo has been set up for your account you may be prompted for a password (which will explicitly be your own current password), or you may be granted unauthenticated rights to perform specific limited or all commands through sudo.

The downside is that it will not be setup for users by default, but it is the accepted "correct" way to perform administrative tasks. Logging in as "root" should only be a last resort.

gcato
Contributor

Hi Chawagon03,

The splunk user is just like any other user on the LINUX system, so, assuming you're using local authentication, you need to set a local password for the "splunk" user. As the root user (or a system user with appropriate sudo permissions), simply use the "passwd splunk" command and set a password. For example:

root@fwdr:~# passwd splunk
Enter new UNIX password:
Retype new UNIX password:
passwd: password updated successfully
root@fwdr:~#

Hope this helps.

0 Karma

grijhwani
Motivator

I have to disagree with this. Although you can assign it a password, you should not.

Since splunk services run as root on bootup, the splunk account should not be provided with a login password, and limited su access should be through su-enabled accounts (with sudo).

0 Karma

gcato
Contributor

I can't argue with that and agree your answer is best practise. I guess it all depends on the use case, environment and risk profile that chawagon03 is working with on the approach to take.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...