Getting Data In

On a Linux host, is a Splunk user account needed if you are running forwarder as root?

zach_sawyerS24
Engager

Hello,

On a Linux host, in which we are installing universal forwarder (using rpm installer), if we install and plan to run as root, is there any actual need for the Splunk account that gets created upon rpm install? Can we delete this user?

Thank you

0 Karma
1 Solution

FritzWittwer_ol
Contributor

For Splunk, the splunk user is certainly not required if you run Splunk as root, but I would never change something which has been added with a package, just to keep the integrity of the system.
You could use the tarball instead of the rpm, then you will not have the splunk user added at all, if you want a rpm without the splunk user, then you should probably create a new rpm from the tarball and use this one, but I am not that much familiar with rpm.

Just a cautionary warning, running the universal forwarder as root may impose security risks, any scripted input deployed via the deployment server or the management port runs as root on the system and has the potential to do anything on the system.

View solution in original post

FritzWittwer_ol
Contributor

For Splunk, the splunk user is certainly not required if you run Splunk as root, but I would never change something which has been added with a package, just to keep the integrity of the system.
You could use the tarball instead of the rpm, then you will not have the splunk user added at all, if you want a rpm without the splunk user, then you should probably create a new rpm from the tarball and use this one, but I am not that much familiar with rpm.

Just a cautionary warning, running the universal forwarder as root may impose security risks, any scripted input deployed via the deployment server or the management port runs as root on the system and has the potential to do anything on the system.

zach_sawyerS24
Engager

I will take all of this into account, thank you

0 Karma

adonio
Ultra Champion

why rpm then and not tgz?

zach_sawyerS24
Engager

Our puppet team has decided rpm is the best route for them for deployment.

0 Karma

woodcock
Esteemed Legend

Your security team will likely say that root is the wrong route for deployment. It is a TERRIBLE idea and a HUGE security hole allowing anybody with access to the DS to have root on all DCs with the click of a few buttons.

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...