On a Linux host, is a Splunk user account needed if you are running forwarder as root?

[zach_sawyerS24]

Hello,

On a Linux host, in which we are installing universal forwarder (using rpm installer), if we install and plan to run as root, is there any actual need for the Splunk account that gets created upon rpm install? Can we delete this user?

Thank you

[FritzWittwer_ol · Accepted solution]

For Splunk, the splunk user is certainly not required if you run Splunk as root, but I would never change something which has been added with a package, just to keep the integrity of the system.
You could use the tarball instead of the rpm, then you will not have the splunk user added at all, if you want a rpm without the splunk user, then you should probably create a new rpm from the tarball and use this one, but I am not that much familiar with rpm.

Just a cautionary warning, running the universal forwarder as root may impose security risks, any scripted input deployed via the deployment server or the management port runs as root on the system and has the potential to do anything on the system.

[zach_sawyerS24]

I will take all of this into account, thank you

[adonio]

why rpm then and not tgz?

[zach_sawyerS24]

Our puppet team has decided rpm is the best route for them for deployment.

[woodcock]

Your security team will likely say that root is the wrong route for deployment. It is a TERRIBLE idea and a HUGE security hole allowing anybody with access to the DS to have root on all DCs with the click of a few buttons.