Linux Universal Forwarder - Security Recommendations

[splk]

Hello Splunk-Community,

for month we are discussing with our Linux admins, if it is ok to install Splunk Universal Forwarder on Linux (Red Hat) or not.
We just want to collect Tomcat / Apache logs from various Linux Hosts, and really don't know how.

The main concern is the management of the needed permissions (per Host / Application for about 1000 Linux Systems) to get the Forwarder to the needed application log directories. We don't want to run the Forwarder as root.

So what are you doing? Do you have any best practices?
I can't belive we are the only one facing this discussion.

Thank you

PS: As a side note, at Windows it seems to be ok to run the Forwarder as System Service.....

[gcusello]

Hi splk,
Apache logs have usually read rights for group (640), in this case you could install UF using a not root user (a new one without shell active) but belonging to the same group of the logs owner.

At https://docs.splunk.com/Documentation/Splunk/7.3.1/Installation/RunSplunkasadifferentornon-rootuser you can find instruction to install Splunk on linux as not root user.

Bye.
Giuseppe

[wenthold]

We've solved this by creating a group on the systems that has read access only to the log files we want to process.

We configured the syslog service (rsyslog) to write logs with the file permissions 640 with the file group ownership set to the log review group, and we've added the Splunk forwarder service account to this group. You also have to mind your directory permissions to make sure that the Splunk service account can access the directory tree & enumerate/read files.

Also make sure the forwarder web interface is disabled and the service account is properly restricted.