Getting Data In

Prevent local install of app in universal forwarders

sf_user_199
Path Finder

Currently, apps on our universal forwarders are controlled by the deployment server, and the forwarder RPM & deploymentClient.conf are installed by Puppet. Even with this setup, you can still put an app in the local forwarder's app directory, and the forwarder will run it.

What can I do to only allow apps from the universal forwarder to run?

0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

Pretty much you would have to do it like you'd protect any other application (or the OS itself) on the remote machine: set up user and file system (and other) permissions to prevent modification of the application. This may mean installing and running Splunk as a a special user.

I do note that using puppet, you can fairly easily ensure that the $SPLUNK_HOME/etc/apps (and in fact the entire etc folder) does not get modified, and that if it does, puppet brings it back into sync.

View solution in original post

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Pretty much you would have to do it like you'd protect any other application (or the OS itself) on the remote machine: set up user and file system (and other) permissions to prevent modification of the application. This may mean installing and running Splunk as a a special user.

I do note that using puppet, you can fairly easily ensure that the $SPLUNK_HOME/etc/apps (and in fact the entire etc folder) does not get modified, and that if it does, puppet brings it back into sync.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...