Getting Data In

On a Linux host, is a Splunk user account needed if you are running forwarder as root?

zach_sawyerS24
Engager

Hello,

On a Linux host, in which we are installing universal forwarder (using rpm installer), if we install and plan to run as root, is there any actual need for the Splunk account that gets created upon rpm install? Can we delete this user?

Thank you

0 Karma
1 Solution

FritzWittwer_ol
Contributor

For Splunk, the splunk user is certainly not required if you run Splunk as root, but I would never change something which has been added with a package, just to keep the integrity of the system.
You could use the tarball instead of the rpm, then you will not have the splunk user added at all, if you want a rpm without the splunk user, then you should probably create a new rpm from the tarball and use this one, but I am not that much familiar with rpm.

Just a cautionary warning, running the universal forwarder as root may impose security risks, any scripted input deployed via the deployment server or the management port runs as root on the system and has the potential to do anything on the system.

View solution in original post

FritzWittwer_ol
Contributor

For Splunk, the splunk user is certainly not required if you run Splunk as root, but I would never change something which has been added with a package, just to keep the integrity of the system.
You could use the tarball instead of the rpm, then you will not have the splunk user added at all, if you want a rpm without the splunk user, then you should probably create a new rpm from the tarball and use this one, but I am not that much familiar with rpm.

Just a cautionary warning, running the universal forwarder as root may impose security risks, any scripted input deployed via the deployment server or the management port runs as root on the system and has the potential to do anything on the system.

zach_sawyerS24
Engager

I will take all of this into account, thank you

0 Karma

adonio
Ultra Champion

why rpm then and not tgz?

zach_sawyerS24
Engager

Our puppet team has decided rpm is the best route for them for deployment.

0 Karma

woodcock
Esteemed Legend

Your security team will likely say that root is the wrong route for deployment. It is a TERRIBLE idea and a HUGE security hole allowing anybody with access to the DS to have root on all DCs with the click of a few buttons.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...