Getting Data In
Highlighted

On a Linux host, is a Splunk user account needed if you are running forwarder as root?

Hello,

On a Linux host, in which we are installing universal forwarder (using rpm installer), if we install and plan to run as root, is there any actual need for the Splunk account that gets created upon rpm install? Can we delete this user?

Thank you

0 Karma
Highlighted

Re: On a Linux host, is a Splunk user account needed if you are running forwarder as root?

SplunkTrust
SplunkTrust

why rpm then and not tgz?

Highlighted

Re: On a Linux host, is a Splunk user account needed if you are running forwarder as root?

Our puppet team has decided rpm is the best route for them for deployment.

0 Karma
Highlighted

Re: On a Linux host, is a Splunk user account needed if you are running forwarder as root?

Esteemed Legend

Your security team will likely say that root is the wrong route for deployment. It is a TERRIBLE idea and a HUGE security hole allowing anybody with access to the DS to have root on all DCs with the click of a few buttons.

0 Karma
Highlighted

Re: On a Linux host, is a Splunk user account needed if you are running forwarder as root?

Contributor

For Splunk, the splunk user is certainly not required if you run Splunk as root, but I would never change something which has been added with a package, just to keep the integrity of the system.
You could use the tarball instead of the rpm, then you will not have the splunk user added at all, if you want a rpm without the splunk user, then you should probably create a new rpm from the tarball and use this one, but I am not that much familiar with rpm.

Just a cautionary warning, running the universal forwarder as root may impose security risks, any scripted input deployed via the deployment server or the management port runs as root on the system and has the potential to do anything on the system.

View solution in original post

Highlighted

Re: On a Linux host, is a Splunk user account needed if you are running forwarder as root?

I will take all of this into account, thank you

0 Karma