Getting Data In

On a Linux host, is a Splunk user account needed if you are running forwarder as root?

zach_sawyerS24
Engager

Hello,

On a Linux host, in which we are installing universal forwarder (using rpm installer), if we install and plan to run as root, is there any actual need for the Splunk account that gets created upon rpm install? Can we delete this user?

Thank you

0 Karma
1 Solution

FritzWittwer
Contributor

For Splunk, the splunk user is certainly not required if you run Splunk as root, but I would never change something which has been added with a package, just to keep the integrity of the system.
You could use the tarball instead of the rpm, then you will not have the splunk user added at all, if you want a rpm without the splunk user, then you should probably create a new rpm from the tarball and use this one, but I am not that much familiar with rpm.

Just a cautionary warning, running the universal forwarder as root may impose security risks, any scripted input deployed via the deployment server or the management port runs as root on the system and has the potential to do anything on the system.

View solution in original post

FritzWittwer
Contributor

For Splunk, the splunk user is certainly not required if you run Splunk as root, but I would never change something which has been added with a package, just to keep the integrity of the system.
You could use the tarball instead of the rpm, then you will not have the splunk user added at all, if you want a rpm without the splunk user, then you should probably create a new rpm from the tarball and use this one, but I am not that much familiar with rpm.

Just a cautionary warning, running the universal forwarder as root may impose security risks, any scripted input deployed via the deployment server or the management port runs as root on the system and has the potential to do anything on the system.

View solution in original post

zach_sawyerS24
Engager

I will take all of this into account, thank you

0 Karma

adonio
Ultra Champion

why rpm then and not tgz?

zach_sawyerS24
Engager

Our puppet team has decided rpm is the best route for them for deployment.

0 Karma

woodcock
Esteemed Legend

Your security team will likely say that root is the wrong route for deployment. It is a TERRIBLE idea and a HUGE security hole allowing anybody with access to the DS to have root on all DCs with the click of a few buttons.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!